The vulnerability is a classic SQL injection flaw in Qcms version 6.0.6. An attacker who can submit crafted input to the vulnerable table field action can inject arbitrary SQL, leading to control over the database and potentially remote code execution on the hosting system. This directly compromises confidentiality, integrity, and availability, granting the attacker full system compromise if the application runs with sufficient privileges.

The flaw is present only in Qcms, version 6.0.6, as identified by the advisory URL. No other vendors or product variants have been listed; therefore, only installations of that exact version are vulnerable.

With an EPSS score of < 1% and no listing in CISA’s KEV catalog, the quantitative likelihood is low but not zero, suggesting the field may be exploitable. The CVSS score of 9.8 indicates a catastrophic severity, confirming the remote code execution capability and supporting a high threat level. The likely attack vector is remote over the network via the backend API that handles the table field action, though the exact requirements are inferred from the description.