CVE-2016-8640

CVE-2016-8640 is a critical SQL injection vulnerability affecting pycsw versions prior to 2.0.2, 1.10.5, and 1.8.6. This flaw allows an unauthenticated attacker to read and extract any data from the pycsw database. On PostgreSQL, it further enables unauthorized updates, inserts, deletions, and modifications to any accessible table. With a CVSS score of 9.1 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, leading to high impact on confidentiality and integrity. Despite its severity, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal.