CVE-2026-3818

5.5 mediumEPSS 0.4%

Medium (5.5) in tiandy easy7 cms. EPSS 0.4% chance of exploitation in the next 30 days.

A flaw has been found in Tiandy Easy7 CMS Windows 7.17.0. Impacted is an unknown function of the file /Easy7/apps/WebService/GetDBData.jsp. This manipulation of the argument strTBName causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWEs: CWE-89, CWE-74
Published: 2026-03-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tiandy:easy7_cms

References

https://my.feishu.cn/docx/RvTMdXwUqowtxNxt9BFcD3TOn3f?from=from_copylink
https://vuldb.com/?ctiid.349784
https://vuldb.com/?id.349784
https://vuldb.com/?submit.769536

Check your stack JSON