Cyber Resilience

CVE-2026-3818

Medium

Published: 09 March 2026

Published
09 March 2026
Modified
10 March 2026
KEV Added
—
Patch
—
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0042 33.5th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-3818 is a medium-severity Injection (CWE-74) vulnerability in Tiandy Easy7 Cms. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-3818 is a SQL injection vulnerability (CWE-74, CWE-89) in Tiandy Easy7 CMS Windows version 7.17.0. The flaw resides in an unknown function within the file /Easy7/apps/WebService/GetDBData.jsp, where manipulation of the argument strTBName triggers the injection.

The vulnerability enables remote exploitation by unauthenticated attackers (PR:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful attacks can result in limited impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), earning a CVSS v3.1 base score of 7.3.

VulDB advisories indicate that an exploit has been published and is available for use. The vendor was contacted early regarding disclosure but provided no response, and no patches or specific mitigations are detailed in the references.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

A flaw has been found in Tiandy Easy7 CMS Windows 7.17.0. Impacted is an unknown function of the file /Easy7/apps/WebService/GetDBData.jsp. This manipulation of the argument strTBName causes sql injection. The attack may be initiated remotely. The exploit has been published…

more

and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated SQL injection in public-facing JSP endpoint (GetDBData.jsp) directly enables exploitation of internet-facing applications for initial access and limited data manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-2116Shared CWE-74, CWE-89
CVE-2025-15436Shared CWE-74, CWE-89
CVE-2026-6148Shared CWE-74, CWE-89
CVE-2026-3792Shared CWE-74, CWE-89
CVE-2026-9447Shared CWE-74, CWE-89
CVE-2026-6153Shared CWE-74, CWE-89
CVE-2025-0699Shared CWE-74, CWE-89
CVE-2025-7218Shared CWE-74, CWE-89
CVE-2026-5564Shared CWE-74, CWE-89
CVE-2026-7063Shared CWE-74, CWE-89

Affected Assets

tiandy
easy7 cms
7.17.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of the strTBName argument before it reaches the SQL query in GetDBData.jsp, blocking the injection vector.

AC-6 Least Privilege partial match
prevent

Limits the database privileges granted to the web-service account so that even a successful injection yields minimal data exposure or modification.

SI-4 System Monitoring partial match
detect

Enables monitoring of database or application query patterns to identify the anomalous strTBName payloads characteristic of this published exploit.

References