Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for PDM Product Data Management System by Shandong Hoteam

    CVE-2026-18854 (GCVE-0-2026-18854)

    Vulnerability from nvd – Published: 2026-08-05 00:00 – Updated: 2026-08-05 14:55
    VLAI
    Title
    Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection
    Summary
    A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    7.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    7.3 (High)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-05 14:55 UTC
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/385866 vdb-entrytechnical-description
    https://vuldb.com/vuln/385866/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-18854 third-party-advisory
    https://vuldb.com/submit/858470 third-party-advisory
    https://ucn9h68n9289.feishu.cn/docx/NEAJdL0fgoCy2… exploit
    Impacted products
    Vendor Product Version
    Shandong Hoteam PDM Product Data Management System Affected: 8.3.0
    Affected: 8.3.1
    Affected: 8.3.2
    Affected: 8.3.3
    Affected: 8.3.4
    Affected: 8.3.5
    Affected: 8.3.6
    Affected: 8.3.7
    Affected: 8.3.8
    Affected: 8.3.9
    Affected: 8.3.10
        cpe:2.3:a:shandong_hoteam:pdm_product_data_management_system:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    red88-debug (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18854",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T14:55:16.889783Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T14:55:22.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:shandong_hoteam:pdm_product_data_management_system:*:*:*:*:*:*:*:*"
          ],
          "product": "PDM Product Data Management System",
          "vendor": "Shandong Hoteam",
          "versions": [
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.3.1"
            },
            {
              "status": "affected",
              "version": "8.3.2"
            },
            {
              "status": "affected",
              "version": "8.3.3"
            },
            {
              "status": "affected",
              "version": "8.3.4"
            },
            {
              "status": "affected",
              "version": "8.3.5"
            },
            {
              "status": "affected",
              "version": "8.3.6"
            },
            {
              "status": "affected",
              "version": "8.3.7"
            },
            {
              "status": "affected",
              "version": "8.3.8"
            },
            {
              "status": "affected",
              "version": "8.3.9"
            },
            {
              "status": "affected",
              "version": "8.3.10"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "red88-debug (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T00:00:40.563Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-385866 | Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/385866"
        },
        {
          "name": "VDB-385866 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/385866/cti"
        },
        {
          "name": "CVE-2026-18854 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-18854"
        },
        {
          "name": "Submit #858470 | Shandong Hoteam Software Co., Ltd. Hoteam PDM 8.3.10 CWE-89 (SQL Injection)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858470"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://ucn9h68n9289.feishu.cn/docx/NEAJdL0fgoCy2jxQwVBcR2mOn7e?from=from_copylink"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-04T17:58:56.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-18854",
    "datePublished": "2026-08-05T00:00:40.563Z",
    "dateReserved": "2026-08-04T15:53:46.665Z",
    "dateUpdated": "2026-08-05T14:55:22.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-18854 (GCVE-0-2026-18854)

    Vulnerability from cvelistv5 – Published: 2026-08-05 00:00 – Updated: 2026-08-05 14:55
    VLAI
    Title
    Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection
    Summary
    A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    7.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    7.3 (High)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-05 14:55 UTC
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/385866 vdb-entrytechnical-description
    https://vuldb.com/vuln/385866/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-18854 third-party-advisory
    https://vuldb.com/submit/858470 third-party-advisory
    https://ucn9h68n9289.feishu.cn/docx/NEAJdL0fgoCy2… exploit
    Impacted products
    Vendor Product Version
    Shandong Hoteam PDM Product Data Management System Affected: 8.3.0
    Affected: 8.3.1
    Affected: 8.3.2
    Affected: 8.3.3
    Affected: 8.3.4
    Affected: 8.3.5
    Affected: 8.3.6
    Affected: 8.3.7
    Affected: 8.3.8
    Affected: 8.3.9
    Affected: 8.3.10
        cpe:2.3:a:shandong_hoteam:pdm_product_data_management_system:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    red88-debug (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18854",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T14:55:16.889783Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T14:55:22.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:shandong_hoteam:pdm_product_data_management_system:*:*:*:*:*:*:*:*"
          ],
          "product": "PDM Product Data Management System",
          "vendor": "Shandong Hoteam",
          "versions": [
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.3.1"
            },
            {
              "status": "affected",
              "version": "8.3.2"
            },
            {
              "status": "affected",
              "version": "8.3.3"
            },
            {
              "status": "affected",
              "version": "8.3.4"
            },
            {
              "status": "affected",
              "version": "8.3.5"
            },
            {
              "status": "affected",
              "version": "8.3.6"
            },
            {
              "status": "affected",
              "version": "8.3.7"
            },
            {
              "status": "affected",
              "version": "8.3.8"
            },
            {
              "status": "affected",
              "version": "8.3.9"
            },
            {
              "status": "affected",
              "version": "8.3.10"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "red88-debug (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T00:00:40.563Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-385866 | Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/385866"
        },
        {
          "name": "VDB-385866 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/385866/cti"
        },
        {
          "name": "CVE-2026-18854 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-18854"
        },
        {
          "name": "Submit #858470 | Shandong Hoteam Software Co., Ltd. Hoteam PDM 8.3.10 CWE-89 (SQL Injection)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858470"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://ucn9h68n9289.feishu.cn/docx/NEAJdL0fgoCy2jxQwVBcR2mOn7e?from=from_copylink"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-04T17:58:56.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-18854",
    "datePublished": "2026-08-05T00:00:40.563Z",
    "dateReserved": "2026-08-04T15:53:46.665Z",
    "dateUpdated": "2026-08-05T14:55:22.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}