A flaw in Xiaopi Panel, affecting the /demo.php file of its WAF Firewall component present in versions up to 20260126, allows an attacker to inject raw SQL through the ID argument. The vulnerability is a classic SQL injection that can expose, modify, or delete data in the backend database. The entry point is a publicly reachable HTTP request, and the flaw could be exploited remotely without authentication. The stated CVSS score of 5.3 indicates moderate severity, and the description warns that a public exploit has already been released.

The impact covers deployments of Xiaopi Panel, versions prior to 20260126, where the /demo.php endpoint is enabled. No specific sub‑versions are listed beyond the date cutoff, so any installation using the default WAF Firewall script before that date is considered vulnerable.

Given an EPSS score of less than 1% the likelihood of exploitation in the wild is low at present, and the vulnerability is not catalogued in CISA’s KEV list. Nonetheless, exploitation is straightforward: submit a crafted ID parameter via an HTTP request to /demo.php, and inject arbitrary SQL statements. The attack requires remote network access to the affected machine and does not depend on privileged or authenticated interaction. The moderate CVSS score reflects the potential for data compromise, but the low EPSS mitigates the immediate threat level. Security teams should monitor for anomalous SQL activity and consider the low-attack‐vector risk when prioritizing remediation.