The Open ISES Project 3.30A has a SQL injection flaw in main.php that allows attackers to send POST requests containing a crafted SQL payload through the frm_passwd parameter. Because this input is not sanitized, unauthenticated users can execute arbitrary SQL commands, enabling them to read sensitive data such as usernames, database names, and version information. This weakness corresponds to CWE‑89, a classic example of an injection vulnerability that compromises data confidentiality.

The vulnerability affects the Open ISES Project, specifically version 3.30A. No other affected versions are listed, and the vendor does not provide additional version information in the CNA data.

The CVSS score of 8.8 indicates a high likelihood of exploitation and significant impact. Although the EPSS score is not available, the lack of authentication requirement and the ability to craft HTTP POST requests to main.php suggest a straightforward attack path. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the absence of mitigation measures in the current release make it a priority for remediation.