PT-2026-36756 · Shandong Hoteam · Pdm Product Data Management System

Red88-Debug · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-7727

NVD

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder causes sql injection. The attack can be initiated remotely. Upgrading to version 8.3.10 is able to mitigate this issue. You should upgrade the affected component.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-7727

Affected Products

Pdm Product Data Management System

References · 6

• 🔥 https://ucn9h68n9289.feishu.cn/wiki/KvbxwRlmRihO8ZkT1E1c64pdngh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7727 · Security Note
• https://en.hoteamsoft.com/pdm · Patch
• https://vuldb.com/submit/803268 · Note
• https://vuldb.com/vuln/360902 · Note
• https://vuldb.com/vuln/360902/cti · Note