A code injection vulnerability exists in the ask_db function of MindSQL version 0.2.1 or earlier. If an attacker supplies a crafted input to this function, the application can execute arbitrary code, compromising the confidentiality, integrity, and availability of the system. The weakness is a direct injection that allows remote actors to run malicious code through the database query interface. No specific authentication requirements are mentioned, implying that the attack can be launched from an unauthenticated or remote user session. The risk is moderate, reflected by a CVSS score of 5.3. The EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog. However, the exploit is publicly disclosed and the vendor has not released a fix, increasing the likelihood of real-world exploitation.

Mindinventory MindSQL versions up to 0.2.1 are affected. Users running any release prior to or including 0.2.1 should verify their installation and check for updates.

This vulnerability carries a moderate severity rating with a CVSS score of 5.3. The lack of an EPSS score means the exact exploitation probability is unknown, but the public availability of the exploit code and the vendor's non‑responsive stance suggest that the potential for use is significant. Attackers can exploit the vulnerability remotely through the ask_db functionality without prior authentication, posing a serious threat if the system is exposed to untrusted inputs.