Opms
Monthly
SQL injection in lock-upme OPMS allows remote low-privileged attackers to manipulate the `ids` argument within the IN Clause Handler of controllers/messages/message.go, potentially enabling unauthorized read and write access to underlying database contents. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network exploitation with low complexity, requiring only a valid low-privileged session, yielding partial confidentiality, integrity, and availability impact. No vendor patch exists as the maintainer did not respond to the coordinated disclosure, and no public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in lock-upme OPMS allows remote low-privileged attackers to manipulate the `ids` argument within the IN Clause Handler of controllers/messages/message.go, potentially enabling unauthorized read and write access to underlying database contents. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network exploitation with low complexity, requiring only a valid low-privileged session, yielding partial confidentiality, integrity, and availability impact. No vendor patch exists as the maintainer did not respond to the coordinated disclosure, and no public exploit or CISA KEV listing has been identified at time of analysis.