PatchSiren

Chanjet CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Chanjet CVE published 2026-06-07

CVE-2026-11456

A SQL injection vulnerability was identified in Chanjet CRM 1.0, specifically in the /tools/jxf_dump_systable.php file. The vulnerability is caused by manipulation of the argument gblOrgID, which leads to SQL injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.