The RSM Design Website Template prior to version 1.2 contains an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. This allows unauthenticated remote attackers to inject SQL code, potentially leading to high confidentiality and system control impact. The CVSS 4.0 base score is 9.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and system control. No official remediation or patch has been published yet, and no exploits are currently known in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. The high CVSS score indicates a critical impact on confidentiality and system control. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider mitigating exposure by restricting access to vulnerable instances, applying web application firewalls with SQL injection protections, and monitoring for suspicious activity related to SQL injection attempts.