This vulnerability affects dameng100 muucmf 1.9.5.20260309 in the getListByPage function of /index/Search/index.html. By manipulating the 'keyword' parameter, an attacker can perform SQL injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. The vendor has not issued a patch or advisory, and the remediation level is unknown.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. Since the attack can be performed remotely without authentication, it poses a significant risk to affected systems. However, the impact is rated medium due to the low scope and impact metrics in the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation or web application firewalls to detect and block SQL injection attempts targeting the 'keyword' parameter. Monitor for updates from the vendor for an official patch or fix.