CVE-2026-71808

HighCVSS 8.8

Published: 09/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).

Risk Assessment

An attacker can gain unauthorized access to data, modify or delete it, potentially leading to integrity and confidentiality breaches.

Recommendation

Update siam-server to a version that uses parameterized queries or prepared statements, and conduct a code audit for similar vulnerabilities.

Other vulnerabilities in Siam Ordering

CVE-2026-71809High
In Siam Ordering (siam-server) version 1.0.0, there is an authentication bypass vulnerability via a hardcoded master verification code. Remote unauthenticated attackers can log in as any user, merchant, or administrator.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS