QwikSec

Security Database

CVE

CWE

Training

CVE-2026-1412

Published: Jan 26, 2026

Modified: Feb 23, 2026

PUBLISHED

CVSS v3.1

7.3

HIGH

Description

A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/get_clip_img of the component HTTP POST Request Handler. Such manipulation of the argument frame/dirno leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Vendor	Product	Versions
Sangfor	Operation and Maintenance Security Management System	affected `3.0.0` affected `3.0.1` affected `3.0.2` affected `3.0.3` affected `3.0.4` +8 more versions

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

VDB-342801 | Sangfor Operation and Maintenance Security Management System HTTP POST Request get_clip_img command injection

vdb-entry

technical-description

VDB-342801 | CTI Indicators (IOB, IOC, TTP, IOA)

signature

permissions-required

Submit #736513 | Sangfor Operation and Maintenance Security Management System (OSM / 运维安全管理系统) v3.0.12 Command Injectiona

third-party-advisory

https://github.com/LX-LX88/cve/issues/22

broken-link

exploit

issue-tracking

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.