CVE-2026-7695
Deferred Deferred - Pending Action
SQL Injection in Acrel EEMS Cloud Platform

Publication date: 2026-05-03

Last updated on: 2026-05-05

Assigner: VulDB

Description
A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. The manipulation of the argument fCircuitids leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-03
Last Modified
2026-05-05
Generated
2026-06-16
AI Q&A
2026-05-03
EPSS Evaluated
2026-06-15
NVD
CVE-2026-7695
EUVD
EUVD-2026-26833
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
acrel electrical_eems_enterprise_power_operation_and_maintenance_cloud_platform 1.3.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. It involves an SQL injection flaw in an unknown function within the file /SubstationWEBV2/main/elecMaxMinAvgValue. Specifically, the vulnerability is triggered by manipulating the argument fCircuitids, which allows an attacker to inject malicious SQL code.

The attack can be initiated remotely without any authentication, making it easier for attackers to exploit. The vulnerability has been publicly disclosed, and the vendor did not respond to the disclosure.

Impact Analysis

This SQL injection vulnerability can lead to unauthorized access to the database, allowing attackers to read, modify, or delete sensitive data. It can also compromise the integrity and availability of the affected system.

Since the attack can be performed remotely without authentication, it increases the risk of exploitation, potentially leading to data breaches, service disruption, or further attacks within the network.

Compliance Impact

The vulnerability is a SQL injection in the Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform, which can lead to unauthorized access or manipulation of data.

Such unauthorized access or data manipulation could potentially impact compliance with data protection standards and regulations like GDPR or HIPAA, which require safeguarding sensitive data against unauthorized access and ensuring data integrity.

However, the provided information does not specify the exact nature of the data affected or the compliance implications.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart