A SQL injection vulnerability (CVE-2026-1449) has been discovered in Hisense TransTech Smart Bus Management System up to version 20260113. The flaw affects the Page_Load function in the TireMng.aspx file, where manipulation of the 'key' argument leads to SQL injection. The vulnerability can be exploited remotely, and a public exploit is available. The vendor was contacted but did not respond to the disclosure.