Quick answers
- Is CVE-2026-18854 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18854 being exploited in the wild.
- How severe is CVE-2026-18854?
- High severity, with a CVSS score of 7.3, published 5 August 2026.
- Which products and versions are affected?
- Shandong Hoteam PDM up to 8.3.10.
- Is there a fix for CVE-2026-18854?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-18854 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-18854?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a SQL injection flaw in the GetStoredClassByFilter method of the DataService endpoint (/Base/BaseService.asmx/DataService) in Shandong Hoteam PDM up to version 8.3.10. The FilterString parameter is insufficiently sanitized before being used in SQL queries, allowing an attacker to inject malicious SQL code. The attack is remotely exploitable without requiring authentication. An attacker can leverage this to read, modify, or delete database records, potentially compromising confidential product and business information. The vendor did not respond to early disclosure attempts.
Affected products
- Shandong Hoteam PDM up to 8.3.10
Timeline
- 2026-08-05: disclosed