CVE-2026-50782
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
XML External Entity (XXE) vulnerability in Jinher OA C6. An unauthenticated remote attacker can send a crafted XML payload to the GetXmlHttp endpoint to read arbitrary files from the server via an out-of-band attack.
Risk Assessment
Leakage of sensitive system files, such as configurations or credentials.
Recommendation
Disable external XML entity processing in the XML parser or update to a patched version.
Other vulnerabilities in Jinher OA C6
See all- CVE-2026-124331High
A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-11412Medium
In Jinher OA C6, an SQL injection vulnerability was found in the file /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx. Manipulating the queryID argument allows remote attack. The exploit is public, and the vendor did not respond.
Original NVD description (English source)
Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS