Fumasoft Fumeng Cloud — CVE-2023-54400 (Critical)

Date Sep 29, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Fumasoft · Fumeng Cloud

CVE CVE-2023-54400

Critical vendor advisory CVE-2023-54400

Summary

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, with potential for further compromise of the underlying server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Fumasoft Fumeng Cloud. Patch or mitigate promptly.

Operator check

Review CVE-2023-54400 in your asset inventory. Apply patches per vendor guidance and verify Fumeng Cloud is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2023-54400 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed