This vulnerability affects dameng100 muucmf 1.9.5.20260309 and involves an SQL injection in the getListByPage function of the /index/Search/index.html file. An attacker can manipulate the 'keyword' parameter to inject SQL commands remotely, potentially compromising the database. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. The vendor has not provided any remediation or response, and no official patch is currently available.

Successful exploitation allows remote attackers to perform SQL injection attacks via the 'keyword' parameter, which could lead to unauthorized data access or modification. The impact is rated medium based on the CVSS score of 6.9, reflecting limited but significant risk to confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection. Monitor for any vendor updates or official patches and apply them promptly once available.