CVE-2026-79570

CVSS 9.8 (critical) · published 2026-09-08

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

Weakness: CWE-89

Source: NVD CVE-2026-79570

References

• https://github.com/fangtang7/CVE/blob/main/mfish-nocode/sql.md
• https://github.com/fangtang7/CVE/blob/main/mfish-nocode/sql.md

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.