An unauthenticated attacker can exploit a SQL injection flaw in the keyword parameter of the /index/controller/Search.php endpoint of MuuCMF T6 v1.9.4.20260115. The flaw permits arbitrary SQL commands to be executed against the database, enabling a complete dump or modification of the database, elevation to administrative privileges, and writing of malicious files to the server’s file system, which can culminate in remote code execution.

MuuCMF T6 v1.9.4.20260115 (the affected version is only the one listed; no other versions are documented).

The EPSS score is below 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in KEV. The attack path is simple: an unauthenticated HTTP request with a crafted keyword value triggers the injection. Because the endpoint accepts user input without proper sanitization, the attacker can control the SQL statement. The CVSS score of 7.3 indicates a high severity level. The potential damage ranges from full database compromise to remote code execution, making the risk very high. The exploitation does not require prior authentication or special network access beyond reaching the vulnerable endpoint.