CVE-2026-110609highCWE-89

CVE-2026-110609: falha de alta gravidade em dromara skyeye

Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

Publicada em

Seguir esta CVE+ Monitorar skyeye

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.5%
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
dromara · skyeye
CVEs relacionadas — dromara skyeye

No mesmo produto, das mais perigosas para as menos.

CVE-2026-107780CRITICALDromara Skyeye Unauthenticated OS Command Injection via textToSpeech format ParameterEPSS 2.1%CVE-2026-107779CRITICALDromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCEEPSS 0.5%CVE-2026-107781CRITICALDromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileByIdEPSS 0.3%