The vulnerability is a classic SQL injection in the order_by parameter of the manage_privilege export endpoint. Authenticated attackers can craft POST requests to /nocms/main/manage_privilege/index/export and embed malicious SQL in order_by[0] to manipulate queries and exfiltrate sensitive database data, potentially compromising confidentiality of the entire system.

The affected product is No-CMS 1.0 from the vendor goFrendiAsgard (ASGARD). All installations using this version are vulnerable; no specific sub‑versions are listed beyond 1.0.

With a CVSS score of 7.1 the vulnerability is considered high severity. Because the EPSS score is not available, the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, but it requires authenticated access to the export endpoint, so the attack vector is likely an authenticated internal attacker. If the attacker obtains valid credentials, they can harvest sensitive data before the patch is applied.