VULNERABILITY INTELLIGENCE

CVE-2026-110609

CVSS score7.1 HIGH

EPSS probability0.28%

CISA KEVNot currently listed

Published2026-10-14

Last modified2026-10-15

Description

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWareh…