CVE Intelligence
Analysis AI-assisted

CVE-2026-2122: Xiaopi Panel WAF Firewall SQL Injection

A SQL injection flaw (CWE-89) has been reported in the WAF Firewall component of Xiaopi Panel, reachable through the ID argument of /demo.php and exploitable remotely. The NVD assessment gives a CVSS 3.1 base score of 9.8, while VulDB as CNA published lower scores. The exploit has been made public, the vendor did not respond, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2122 is a SQL injection vulnerability (CWE-89) in the WAF Firewall component of Xiaopi Panel, specifically in the ID argument handled by the file /demo.php. The record was published on 2026-02-08 by VulDB as CNA. According to the description, the flaw affects Xiaopi Panel up to version 20260126.

Impact

  • Confirmed: the NVD assessment gives a base score of 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning network-reachable, low complexity, no privileges or user interaction required, and high confidentiality, integrity and availability impact.
  • Inference: a successful SQL injection in a web-facing management component can expose or alter database content and may disrupt the service.

Affected products and versions

  • Product: Xiaopi Panel, WAF Firewall component, file /demo.php.
  • Range stated in the record: up to 20260126 (listed as up to 2026-01-26).
  • No fixed version is listed in the record.

Exploitation status

  • CVE-2026-2122 is not listed in the CISA KEV catalog in this record, so no confirmed active exploitation is reported in the sources consulted.
  • The description states that the exploit has been released to the public and may be used for attacks. Public exploit material raises risk, but this record does not confirm its use against any system.
  • The EPSS probability is 0.0031 (about 0.31 percent), with a percentile of 0.22077.

Remediation and mitigation

  • The record contains no vendor fix, and the vendor did not respond to early disclosure. Treat affected deployments as unpatched unless the vendor confirms otherwise.
  • Restrict access to the Xiaopi Panel administrative interface to trusted networks and VPN users.
  • Disable or remove the WAF Firewall component and any demonstration files such as /demo.php where they are not required.
  • Apply defense in depth: use least-privilege database accounts for the application and confirm that any custom code uses parameterized queries.
  • If no vendor fix becomes available, consider replacing the product following your organization's risk process.

Detection guidance

  • Review web server and application logs for requests to /demo.php with unusual or malformed values in the ID parameter, and for repeated database-related errors.
  • Monitor WAF or IDS alerts for SQL injection patterns targeting the panel and correlate them with source addresses.
  • Check for unexpected database changes, new accounts or bulk data exports originating from the panel host.

Limitations of the available information

  • The record contains no fixed version, patch or vendor advisory.
  • The vendor did not respond, so vendor-confirmed affected version boundaries are unknown beyond the range given.
  • CVSS scores differ by source: NVD CVSS 3.1 score 9.8; VulDB CNA scores of 2.1 (CVSS 4.0), 6.3 (CVSS 3.1) and 6.5 (CVSS 2.0). The NVD score is the primary score in the record.
  • A GitHub issue referenced in the record is marked Not Applicable, and its content was not analyzed here.
  • Details of the vulnerable code path and any preconditions beyond the stated vector are not in the record.

Frequently asked questions

Which Xiaopi Panel versions are affected by CVE-2026-2122?

The record states the flaw affects Xiaopi Panel up to version 20260126, listed as up to 2026-01-26. No fixed version is given in the record.

Is CVE-2026-2122 being actively exploited?

The record does not list it in the CISA KEV catalog, so no confirmed active exploitation appears in the sources consulted. The description does state that a public exploit exists and may be used for attacks.

What should administrators do now?

Restrict access to the administrative interface, disable the WAF Firewall component and demonstration files where they are not needed, use least-privilege database accounts, and monitor logs for unusual ID parameter activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.