TVN ID	TVN-202402006
CVE ID	CVE-2024-26264
CVSS	9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products	RISWEB 1.x、2.x
Description	EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.
Solution	Update to 3.x or later version.
Credit	Security member
Public Date	2024-02-15