This vulnerability in N-Media Bulk Product Sync arises from improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. It affects all versions up to 8.6. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with a critical impact on confidentiality and some impact on availability. No vendor advisory or patch information is provided, and the product is not a cloud service, so remediation status is unknown.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive data (confidentiality impact is high). The integrity impact is not indicated, and availability impact is low. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the affected component and monitor for unusual database activity. No official fixes or temporary mitigations have been published.