CVE-2026-71808

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).

Published 2026-09-09. Last modified 2026-09-10.