A vulnerability in the /server/controller/user.js file of z‑9527 admin 1.0 and 2.0 allows an attacker to inject arbitrary SQL through the checkName, register, login, getUser, and getUsers endpoints. This flaw enables the retrieval or alteration of database contents, potentially exposing sensitive user data or modifying critical application state. The weakness is identified as a classic injection flaw, documented under CWE‑74 and CWE‑89.

The affected product is z‑9527 admin version 1.0 and 2.0. The CVE data does not indicate a publicly available patch or update from the vendor, and vendor contact has not resulted in a response. The product is distributed via the public repositories linked in the advisory.

The vulnerability has a CVSS v3.1 score of 6.9, which denotes moderate severity. The EPSS score is below 1%, indicating a low but non‑zero likelihood of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the attack can be triggered remotely against exposed endpoints, any instance of the affected software exposed to the internet remains at risk for data compromise until mitigation measures are applied.