This vulnerability in Tribulant Software Newsletters (<= 4.9.9.7) arises from improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score is 7.6 (high), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact is high confidentiality loss, no integrity impact, and low availability impact. No known exploits in the wild have been reported, and no patch or vendor advisory is currently provided.

An attacker with high privileges can exploit this SQL Injection vulnerability to access sensitive data in the database, resulting in a high confidentiality impact. The vulnerability does not affect data integrity but may cause a low impact on system availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and monitor for suspicious activity related to SQL queries in the Newsletters plugin.