This vulnerability in Pierre Lannoy DecaLog (<= 3.9.0) involves improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. It allows an attacker with high privileges to manipulate SQL queries, potentially leading to unauthorized disclosure of sensitive information. The CVSS score is 7.6 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with high confidentiality impact. No vendor advisory or patch links are currently available, and the product is not a cloud service.

An attacker with high privileges could exploit this SQL Injection vulnerability to access sensitive data, compromising confidentiality. The vulnerability does not impact data integrity but may cause limited availability disruption. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to DecaLog to trusted users with necessary privileges and monitor for unusual database activity related to SQL queries.