This vulnerability (CVE-2024-34412) affects Parcel Panel ParcelPanel through version 3.8.1 and is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). It allows an attacker with low privileges to inject SQL commands due to insufficient input sanitization, potentially leading to partial denial of service and confidentiality impact. The CVSS 3.1 base score is 8.5, indicating high severity, with network attack vector, low attack complexity, no user interaction, and scope changed. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to execute unauthorized SQL commands, potentially leading to partial denial of service and confidentiality breaches within the affected ParcelPanel application. The vulnerability requires low privileges and no user interaction, increasing the risk. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected ParcelPanel instances and monitor for unusual database activity. Avoid exposing the application to untrusted networks where possible.