The vulnerability identified as CVE-2026-51077 affects Dede CMS v5.7.118. It is a SQL injection issue in the sys_sql_query.php component, specifically through the sqlquery parameter. This allows remote attackers to execute unauthorized SQL queries to extract sensitive data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. No known exploits in the wild or vendor patches are documented in the provided data.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the affected Dede CMS instance. The attacker does not require authentication and can remotely trigger the vulnerability, posing a significant confidentiality risk. There is no indication of impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component if possible and monitor for unusual database query activity related to the sqlquery parameter.