This vulnerability originates from missing input validation in the queryDatabase function within ai.php of the Emlog content management system. The flaw permits an attacker to inject malicious SQL commands through user‑controlled parameters, enabling arbitrary execution against the database and potentially exposing, modifying, or deleting critical data. The weakness is categorized as CWE‑89 and carries a CVSS score of 8.6, indicating high risk to confidentiality, integrity, and availability of the underlying database.

Emlog versions 2.6.20 and earlier are affected. Administrators should verify that their installation’s version is 2.6.20 or lower; any instance that deploys ai.php and accepts external input is vulnerable. No other vendors or product versions are listed as impacted in the CNA data.

The CVSS score of 8.6 denotes strong exploitation potential, but the EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not in the CISA KEV catalog. Based on the description, the likely attack vector is a web request to ai.php carrying crafted query parameters that are passed directly into SQL statements. Successful exploitation could lead to complete database compromise.