A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113. Affected is the function Page_Load of the file YZSoft/Forms/XForm/BM/BusC…

A SQL injection vulnerability (CVE-2026-1449) has been discovered in Hisense TransTech Smart Bus Management System up to version 20260113. The flaw affects the Page_Load function in the TireMng.aspx file, where manipulation of the 'key' argument leads to SQL injection. The vulnerability can be exploited remotely, and a public exploit is available. The vendor was contacted but did not respond to the disclosure.