CVE-2026-30995 identifies a SQL injection vulnerability in Slah CMS v1.5.0 and below. The issue exists in the vereador_ver.php endpoint where the id parameter is not properly sanitized, enabling an attacker to inject SQL commands. This could potentially lead to unauthorized data access or modification depending on the database privileges and application context. No patch or official fix has been documented at this time.

The vulnerability could allow attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data modification, or other database-related impacts. However, no known exploits in the wild have been reported, and the exact impact depends on the deployment environment and database permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or web application firewall rules to mitigate SQL injection risks on the vulnerable parameter.