https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 05:44:36 +0000 https://db.gcve.eu/vuln/cve-2026-110609 <p><strong>Affected:</strong> dromara skyeye</p> <p>Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants&#39; data, using boolean, UNION, error or time-based techniques.</p> <p><strong>Affected:</strong> dromara skyeye</p> <p>Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants&#39; data, using boolean, UNION, error or time-based techniques.</p> https://db.gcve.eu/vuln/cve-2026-110609