CVE-2026-6629

CVE-2026-6629 is a SQL injection vulnerability affecting Metasoft MetaCRM versions up to 6.4.0, specifically in the Statement.executeUpdate function within the sql.jsp interface component. The flaw allows attackers to manipulate SQL arguments, enabling unauthorized database access and modification. This vulnerability has a HIGH severity rating with a CVSS score of 7.3, reflecting its broad accessibility and significant potential impact. The attack requires no authentication, can be executed remotely over the network, and presents minimal complexity for exploitation. While the exploit has been publicly disclosed and the vendor was notified early without response, current EPSS data indicates low prevalence of active exploitation at this time. However, the vulnerability appears on active security watch lists, suggesting ongoing community attention and potential for exploitation escalation.