This vulnerability in Typps Calendarista (up to version 15.5.7) is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It allows an attacker with low privileges to inject malicious SQL commands due to insufficient input sanitization. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level has been published by the vendor, and the product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL queries, potentially leading to disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or temporary fix is currently available, users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the affected application and applying any available input validation or web application firewall rules that might mitigate SQL injection risks.