CVE-2026-1120

CVE-2026-1120 is a critical SQL injection vulnerability affecting Yonyou KSOA 9.0, specifically within the /worksheet/del_work.jsp component. This flaw allows remote attackers to execute arbitrary SQL commands by manipulating the 'ID' parameter in an HTTP GET request. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability compromise. The exploit has been publicly disclosed, and while there's no evidence of active exploitation in the wild or readily available exploit intelligence tools, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.