CVE-2014-9558

CVE-2014-9558 describes multiple critical SQL injection vulnerabilities in SmartCMS v.2. This vulnerability allows an unauthenticated attacker to remotely execute arbitrary SQL commands, potentially leading to full compromise of the affected system, including data theft and manipulation. With a CVSS score of 9.8 (CRITICAL) and a FAUCET Risk Score of 97/100, the attack is trivial to execute over the network with no user interaction required. While not on the KEV catalog, exploit code is publicly available on ExploitDB, and the vulnerability has garnered significant community discussion, indicating awareness among threat actors.