CVE-2026-79570

mfish-nocode-pro version 1.0.0 contains an unauthenticated SQL injection flaw (CWE-89) in the tableName parameter of the /sys/dbConnect/data endpoint. An attacker can send a crafted SQL statement in that parameter over the network without credentials or user interaction, because the parameter is not properly sanitized before being used in a database query. Successful exploitation allows the attacker to access sensitive information in the backend database, consistent with the critical CVSS 3.1 score of 9.8 and the high confidentiality, integrity, and availability impact ratings. Any deployment running mfish-nocode-pro 1.0.0 with the /sys/dbConnect/data endpoint reachable is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and EPSS estimates only a 0.3% probability of exploitation within the next 30 days.

What to do: No patched version is stated in the available data, so check the upstream project for a fixed release before upgrading and verify your running version is 1.0.0. In the meantime, restrict network access to /sys/dbConnect/data, validate the tableName parameter (for example via an allow-list), and review access logs for SQL metacharacters or unusual queries in that parameter. If the endpoint must remain internet-exposed, apply a WAF rule blocking SQL syntax in tableName until a patch is available.