AiOPMSD Final 1.0.0 contains a SQL injection flaw in actor.php that allows attackers with no authentication to craft GET requests containing malicious SQL. By injecting payloads into the actor parameter, an attacker can execute arbitrary SQL statements, enabling extraction of sensitive information such as usernames, database names, and version details. The vulnerability is a classic input‑validation weakness classified as CWE‑89, which can lead to compromise of database confidentiality and integrity.

The affected product is AiOPMSD Final. The CVE identifies version 1.0.0 as vulnerable; no other versions are listed in the CNA data.

The CVSS score of 8.8 indicates a high severity. EPSS is not available, so the likelihood of exploitation cannot be quantified from public data. The vulnerability is not listed in CISA’s KEV catalog. Attackers can reach the flaw via unauthenticated HTTP requests to actor.php, making the attack vector web‑based and remote. Given the high score and the lack of authentication requirement, the risk to exposed data is significant.