CVE-2026-4289
CWE-74Published: March 17, 2026· Updated: Mar 17, 2026
Official Description
A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical Analysis
CVE-2026-4289 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
News & Research Mentioning CVE-2026-4289
The company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14. The post Microsoft Patches Exploited Exchange Server Vulnerability appeared first on SecurityWeek. [xlite_meta score:56 src:SecurityWeek xlite_fp:6dee2300f03ba6043abdb9c64638436233a2d7ef838f62971c8f979b1dcba4b8]
Microsoft has shared mitigations for CVE-2026-42897 until a permanent patch can be released for affected Exchange Server versions. The post Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild appeared first on SecurityWeek. [xlite_meta score:56 src:SecurityWeek xlite_fp:480a9903e95f83573fc52cd43bbed0aa03e5132cee560e0f856c61ed8a0b2f52]
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks aga [xlite_meta score:48 src:CISA Alerts xlite_fp:8f0d5bd54e46fb5cfabc3cb725c0c0ee2419ebe6537724dd750301af3e78921a]
Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-42897 (CVSS score: 8.1), has been described as a spoofing bug stemming from a cross-site scripting flaw. An anonymous researcher has been credited with discovering and reporting the issue. " [xlite_meta score:53 src:The Hacker News xlite_fp:95ff4d745c5e9e7617e09fd7122676eb6df7eb4870ce004c59f429fb6feda4ea]
All References (4)
Quick Facts
Related CVEs (CWE-74)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-4289 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts