The vulnerability in CMSsite 1.0 is a classic SQL injection where an attacker can embed arbitrary SQL code into the cat_id parameter of category.php. By crafting a malicious value and sending a simple HTTP GET request, an unauthenticated user can cause the application to perform unintended database operations. The exploit allows extraction of sensitive data such as usernames and passwords, thereby compromising the confidentiality of the system's user accounts.

VictorAlagwu’s CMSsite version 1.0 is affected. Users running this CMS on any environment where category.php is reachable and the cat_id parameter accepts user input without validation are exposed. The problem is confined to the open‑source codebase provided by the vendor; no other products or versions were identified.

The CVSS score of 8.8 classifies the flaw as critical, and while there is no EPSS data available, the lack of requirement for authentication and the simplicity of the GET request suggest a high likelihood of exploitation once a vulnerable instance is discovered. The vulnerability is not listed in the KEV catalog, indicating that no publicly known exploits have been reported yet, but the attack vector is remote over the network and could be automated. Organizations should treat this as a high‑priority risk until a fix is applied.