CVE-2021-44874: Dalmark Systeam Enterprise Resource Planning

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report module exposes direct SQL commands via POST data in order to select data for report generation. A malicious actor can use the bi report endpoint as a direct SQL prompt under the authenticated user.

Affected products

• Dalmark Systeam Enterprise Resource Planning: version 2.22.8 only

Published 2021-12-21. Last modified 2026-06-17.