A vulnerability has been discovered in the jiujiujia, victor123, and wxw850227 distributions of jjjfood and jjjshop_food, affecting code in the /index.php/api/product.category/index script. Manipulation of the latitude argument allows arbitrary SQL statements to be executed, potentially exposing sensitive data or altering database contents. The flaw is identified as a classic SQL injection weakness, classified under CWE-74 and CWE-89. The exploit is available publicly and can be launched remotely without authentication, meaning that whoever can reach the endpoint may compromise data confidentiality and integrity.

Affected vendors are jiujiujia, victor123, and wxw850227. The vulnerable products are jjjfood and jjjshop_food, with all vendor builds up to version 20260103. No specific patch versions are listed, so any installation of the mentioned products prior to or at that date is considered vulnerable.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of < 1% reflects a low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the public availability of the exploit suggests that attackers may still attempt to use it. The attack vector is remote, as the vulnerability is triggered by sending a crafted latitude parameter to the exposed endpoint.