CVE-2026-7695
SQL Injection in Acrel EEMS Cloud Platform
Publication date: 2026-05-03
Last updated on: 2026-05-05
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| acrel | electrical_eems_enterprise_power_operation_and_maintenance_cloud_platform | 1.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. It involves an SQL injection flaw in an unknown function within the file /SubstationWEBV2/main/elecMaxMinAvgValue. Specifically, the vulnerability is triggered by manipulating the argument fCircuitids, which allows an attacker to inject malicious SQL code.
The attack can be initiated remotely without any authentication, making it easier for attackers to exploit. The vulnerability has been publicly disclosed, and the vendor did not respond to the disclosure.
How can this vulnerability impact me? :
This SQL injection vulnerability can lead to unauthorized access to the database, allowing attackers to read, modify, or delete sensitive data. It can also compromise the integrity and availability of the affected system.
Since the attack can be performed remotely without authentication, it increases the risk of exploitation, potentially leading to data breaches, service disruption, or further attacks within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a SQL injection in the Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform, which can lead to unauthorized access or manipulation of data.
Such unauthorized access or data manipulation could potentially impact compliance with data protection standards and regulations like GDPR or HIPAA, which require safeguarding sensitive data against unauthorized access and ensuring data integrity.
However, the provided information does not specify the exact nature of the data affected or the compliance implications.