The vulnerability is a classic SQL injection flaw in Qcms version 6.0.6. An attacker who can submit crafted input to the vulnerable table field action can inject arbitrary SQL, leading to control over the database and potentially remote code execution on the hosting system. This directly compromises confidentiality, integrity, and availability, granting the attacker full system compromise if the application runs with sufficient privileges.

The flaw is present only in Qcms, version 6.0.6, as identified by the advisory URL. No other vendors or product variants have been listed; therefore, only installations of that exact version are vulnerable.

With no EPSS score available and no listing in CISA’s KEV catalog, the quantitative likelihood is unknown, but the lack of mitigation information suggests the field is open to exploitation. The CVSS score is not supplied, but given the remote code execution capability and the absence of authentication requirements in the advisory, the threat level is high. The likely attack vector is remote over the network via the backend API that handles the table field action, though the exact requirements are inferred from the description.