A SQL injection flaw has been identified in the qihang-wms application, specifically through the datascope parameter in the SysUserMapper.xml file. Crafted SQL statements inserted via this parameter enable attackers to read sensitive database records, including personally identifiable information of users. The weakness stems from improper handling of user input, allowing a classic data‑exfiltration vector that compromises confidentiality.

The vulnerability targets the qihang-wms system on commit 75c15a. No other vendors or product variants appear in the CNA data, so the primary affected product is the qihang-wms application as referenced in the advisory.

The CVE carries a CVSS score of 6.5, indicating medium severity, and it is not listed in the CISA KEV catalog. An EPSS score is not available, so the likelihood of exploitation is indeterminate from current data. The likely attack vector is a web‑based request that includes a malicious datascope value, though the description does not specify whether authentication is required to submit this parameter.