The vulnerability allows an attacker to inject arbitrary SQL through the email parameter in the PublicController::sendFindPwdMail function. This occurs when the value is directly used in a database query without proper sanitization, leading to potential data exposure or modification. The flaw is a classic SQL injection that can compromise database confidentiality and integrity.

The flaw exists in jackq XCMS versions up to the commit 3fab5342cc509945a7ce1b8ec39d19f701b89261. Users running that version or earlier are susceptible. The affected file is Admin/Home/Controller/PublicController.class.php within the Password Recovery Mail Endpoint component.

The reported CVSS score is 6.9, indicating a moderate severity. EPSS is not available, so public exploitation likelihood cannot be quantified from that metric, and the vulnerability is not listed in CISA KEV. Remote exploitation is possible because the vulnerable endpoint can be reached over the network, and the attacker only needs to craft a malicious email address. The lack of a public exploit and the moderate CVSS suggest careful monitoring but also prompt patching.