CVE-2026-71808

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).

• Published Sep 9, 2026
• CVSS 8.8 high
• 0.5% chance of exploitation in the next 30 days (EPSS)

CVE-2026-71808 at the National Vulnerability Database