This vulnerability in percent20 Golf Tracker (versions up to 0.7) involves improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. An attacker with low privileges and no user interaction can exploit this remotely to compromise confidentiality of the database. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and significant confidentiality impact. No vendor advisory or patch links are provided, and the product is not a cloud service.

Successful exploitation could allow an attacker to read sensitive data from the backend database, compromising confidentiality. Integrity is not impacted, and availability impact is low. The vulnerability requires low privileges but no user interaction, increasing its risk profile. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting database permissions and monitoring for suspicious activity related to SQL queries. Avoid exposing the vulnerable application to untrusted networks if possible.