CVE-2026-79570: SQL Injection
Published Sep 8, 2026
·Updated
mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
Affected Software
1 affected component
mfish-nocode-pro mfish-nocode-pro=1.0.0
Event History
Sep 8, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:18 PM
Description
Frequently Asked Questions
1
Which endpoint and input require remediation review?
Review the /sys/dbConnect/data endpoint, specifically its tableName parameter. The reported issue is SQL injection through a crafted SQL statement supplied in that parameter.
2
What could an attacker obtain if exploitation succeeds?
Successful exploitation can allow access to sensitive database information.