Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-7727: Shandong Hoteam PDM System can be hacked through SQL injection
CVE-2026-7727 · published 6 months ago
Summary
The Shandong Hoteam Software PDM Product Data Management System versions 8.3.9 and older can be exploited by a hacker to execute unauthorized database queries. This could lead to unauthorized access to sensitive data. To fix this, update to version 8.3.10 or later.
Original advisory text
A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asm...
A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder causes sql injection. The attack can be initiated remotely. Upgrading to version 8.3.10 is able to mitigate this issue. You should upgrade the affected component.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published4 May 2026
Updated4 Nov 2026
First seen4 May 2026
Sources
CVE-2026-7727 · NVD
Track software like this
Free during beta