ShowDoc versions up to 3.8.0 contain a SQL injection vulnerability in the API Page Sort Endpoint, specifically in the PageController.class.PHP file. This vulnerability allows remote attackers to manipulate the 'pages' argument to execute SQL injection attacks. The issue is fixed in version 3.8.1. The vendor has stated that patches will not be backported to older versions, so upgrading is necessary to remediate the vulnerability.