CVE-2026-3969 | FeMiner wms up to 1.0 Basic Organizational Structure depart_add_bg.php Name sql injection

A vulnerability marked as critical has been reported in FeMiner wms up to 1.0. This impacts an unknown function of the file /wms-master/src/basic/depart/depart_add_bg.php of the component Basic Organizational Structure Module. Performing a manipulation of the argument Name results in sql injection.

This vulnerability was named CVE-2026-3969. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.