A vulnerability was found in Tiandy Easy7 CMS Windows 7.17.0. It has been rated as critical. Impacted is an unknown function of the file /Easy7/apps/WebService/GetDBData.jsp. This manipulation of the argument strTBName causes sql injection.
This vulnerability appears as CVE-2026-3818. The attack may be initiated remotely. In addition, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
