The vulnerability is a classic SQL injection flaw in the getPageData method of DatacenterQuery.java, allowing attackers to craft malicious input that is executed by the underlying database. This disclosure can expose sensitive data stored in the application. The flaw maps to CWE-89, emphasizing unsanitized input handling. No authentication requirement is mentioned, implying remote access is possible.

Affected software is AiFlowy up to version 2.1.2. Any deployment of AiFlowy 2.1.2 or earlier that exposes the getPageData endpoint may be vulnerable. The vendor is not listed, but the code repository indicates it is provided under an open‑source license. The vulnerability is specific to the DatacenterQuery.java component. Administrators should verify whether their installations run a vulnerable version.

The CVSS score of 7.5 denotes a high‑severity vulnerability with a potential for significant data exposure. The EPSS score of less than 1% suggests that exploitation of this flaw is unlikely at present. The flaw is not listed in the CISA KEV catalog, further supporting a low exploitation probability. Attacks would likely be performed remotely by sending crafted requests to the getPageData endpoint, injecting SQL statements into the query string. If successful, attackers could retrieve arbitrary data from the database.