This vulnerability in light0011 cms involves improper handling of the DB_DEBUG argument in the Debug Mode component, specifically related to the file App/Common/Conf/config.php. Manipulating this argument can lead to information disclosure. The attack can be launched remotely without authentication or user interaction. The product's rolling release model means no explicit affected or fixed versions are identified. The vendor has been notified but has not issued a response or patch. Exploit code is publicly available, increasing risk.

An unauthenticated remote attacker can exploit this vulnerability to disclose sensitive information from the system due to improper processing of the DB_DEBUG argument in the Debug Mode component. This could potentially aid further attacks or reconnaissance. No direct evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, consider disabling Debug Mode or restricting access to the affected component to mitigate exposure.