Threats affecting pkg:github/zhangbuneng/3

CVE-2025-14780 is a medium-severity SQL injection vulnerability in Xiongwei Smart Catering Cloud Platform version 2.1.6446.28761. The flaw exists in an unspecified function within the /dishtrade/dish_trade_detail_get endpoint, where manipulation of the 'filter' parameter allows remote attackers to inject SQL commands. Exploitation requires no user interaction but does require low-level privileges. Although no public exploits are currently observed in the wild, the exploit code has been publicly disclosed, increasing the risk of attacks. The vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system. European organizations using this platform, especially in countries with significant adoption of Xiongwei products or large catering/cloud service sectors, could be impacted. Mitigation involves applying vendor patches once available, implementing strict input validation, and monitoring database queries for anomalies.