CVE-2026-18854: A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/Bas
A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-18854
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-188540.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-18854 | coverage & exploitation status | NVD · CVE.org |
More from NVD Recent CVEs
- highCVE-2026-7529: The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unau…2026-08-05
- mediumCVE-2026-7456: The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to …2026-08-05
- highCVE-2026-67623: Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attacker…2026-08-05
- highCVE-2026-17506: The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi…2026-08-05
- highCVE-2026-16443: A flaw was found in the SAML metadata import functionality of the keycloak-services component,…2026-08-05