CVE-2026-1059 is a high severity (CVSS 7.3) SQL injection in FeMiner WMS, a warehouse management system, through the Username argument in src/chkuser.php. The project uses rolling releases, the vendor did not respond to disclosure, and no fixed version is listed. Restrict access to the app and review its code if you run it.
What's affected
The record names FeMiner wms up to commit 9cad1f1b179a98b9547fd003c23b07c7594775fa, in the file /src/chkuser.php. The project follows a rolling release strategy, so the record cannot give version numbers for affected or fixed releases.
The vendor was contacted early about the disclosure and did not respond. There is no known fix. Do not assume a later commit is safe unless you have read the code.
How to check if you're exposed
There is no package version to check. Use the repository history instead:
git log --oneline | head
git branch --contains 9cad1f1b179a98b9547fd003c23b07c7594775fa
If your copy of the code contains that commit or is based on an earlier one, treat it as affected. Then read src/chkuser.php and look at how the username is passed to the database. If it is built into a query string, the flaw is present in your copy.
What to do now
- Do not expose the application to the internet. Put it behind a VPN or a restricted network.
- If you maintain the code, change the query in
src/chkuser.phpto use prepared statements with bound parameters. - Review database accounts used by the app and cut their rights to the minimum.
- Check logs for unusual login attempts, such as very long or odd usernames.
- Consider replacing the application with one that has an active maintainer.
Why it matters
SQL injection is filed here as CWE-89 with its parent class CWE-74. The login form takes a username and builds a database query from it without separating the data from the query. The fix is old and well understood: prepared statements, where the database treats the input as a value and never as part of the command.
A login check is a bad place for this flaw, because the page is reachable before anyone has authenticated. The vector shows network access, low complexity and no privileges.
The record says the exploit has been disclosed publicly and may be used. It does not report exploitation in the wild, and the KEV flag is false.
Quick check
How do I know if my copy is affected when there are no version numbers?
Check whether your code includes the commit named in the record, or is older, and read how src/chkuser.php builds its query. A query assembled by string concatenation is the problem.
Sources
Last reviewed: 19 October 2026.
