FineAdmin V1.0 contains an SQL injection flaw that can be triggered through the `field` and `order` parameters found on its paginated list endpoints. An attacker who can supply arbitrary content to these parameters may trigger the database engine to execute arbitrary SQL statements, which can lead to gaining control over the application or the underlying database. The vulnerability is a classic input validation failure, enabling the execution of unknown code in the context of the vulnerable application.

FineAdmin version 1.0 is affected. No other versions are listed, and the vendor/vendor information is not supplied.

The CVE lists no EPSS score, meaning the current available data does not quantify exploit probability. Since the vulnerability is not in the CISA KEV catalog, it has not yet been widely reported as exploited. The most likely attack vector is via a simply crafted HTTP request that includes malicious `field` or `order` values. Remote exploitation does not require authentication, and the impact is the potential loss of confidentiality, integrity, and availability of the database and the application.