CVE-2026-2122— Xiaopi Panel WAF Firewall demo.php sql injection
Quick assessment
Affected
Xiaopi Panel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Henan Xiaopi Panel是中国河南小皮（Henan Xiaopi）公司的一个Linux图形化界面。 Henan Xiaopi Panel 20260126及之前版本存在SQL注入漏洞，该漏洞源于对组件WAF Firewall中文件/demo.php的参数ID的错误操作，可能导致SQL注入攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-2122
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Xiaopi Panel WAF Firewall demo.php sql injection
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Henan Xiaopi Panel SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Henan Xiaopi Panel是中国河南小皮（Henan Xiaopi）公司的一个Linux图形化界面。 Henan Xiaopi Panel 20260126及之前版本存在SQL注入漏洞，该漏洞源于对组件WAF Firewall中文件/demo.php的参数ID的错误操作，可能导致SQL注入攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-2122
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-2122
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-2122 (1)
-
🔗 Submit #746917: Xiaopi Web Application Firewall V1.0.0 Bypass Read full article third-party-advisory
IV. Related Vulnerabilities
Same product: Panel
-
CVE-2026-92762
Pelican Panel before 1.0.0-beta35 Authorization Bypass via S -
CVE-2026-86177
Pterodactyl Panel before 1.14.1 Privilege Escalation via Sch -
CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA -
CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload -
CVE-2026-35202
Pterodactyl has a database resource limit bypass via race co
Same weakness: CWE-89
-
CVE-2026-103253
n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Or -
CVE-2026-103248
n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Inj -
CVE-2026-75786
SQL Injection in Grafana Integration Endpoint (query.php) -
CVE-2026-103543
itsourcecode Leave Management System controller.php sql inje -
CVE-2026-102109
Kiteworks Secure Data Forms SQL injection
V. Comments for CVE-2026-2122
No comments yet