CVE-2026-18854

Name of the Vulnerable Software and Affected Versions Shandong Hoteam PDM Product Data Management System versions prior to 8.3.11

Description Remote exploitation is possible through a SQL injection in the /Base/BaseService.asmx/DataService endpoint. The issue occurs when the FilterString argument is manipulated within the GetStoredClassByFilter() function. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations As a temporary workaround, restrict access to the GetStoredClassByFilter() function within the /Base/BaseService.asmx/DataService endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.