Unrated severityNVD Advisory· Published Jul 29, 2026· Updated Jul 30, 2026

CVE-2026-50782

Description

Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack.

Affected products

Jinher/OA C6llm-fuzzy

Patches

Vulnerability mechanics

References

github.com/dihe123/CNVD-Jinher-OA-XXE/blob/main/README.mdmitre
github.com/dihe123/CNVD-Jinher-OA-XXE/tree/mainmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000