A flaw in Slah CMS versions 1.5.0 and earlier permits unauthenticated users to inject arbitrary SQL through the id parameter on the vereador_ver.php endpoint. The injection can read, modify, or delete database records, exposing confidential data and compromising application integrity. The weakness corresponds to CWE‑89.

Any deployment of Slah CMS running version 1.5.0 or older is vulnerable. The affected code resides in vereador_ver.php and is accessible through the web interface. Administrators should confirm the CMS version and review exposure of this endpoint.

The CVSS score of 8.6 indicates high severity. With no EPSS data and absence from the KEV catalog, precise exploitation likelihood remains unknown, yet the flaw is readily exploitable over HTTP by any user who can reach the site. Because the id parameter is user‑controlled and no authentication is required, attackers can perform data exfiltration, corruption, or deletion. The risk remains significant for unpatched systems.