This vulnerability in marcoingraiti Actionwear products sync (versions <= 2.3.3) involves improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 8.5 (high), with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact is a partial loss of confidentiality and low impact on availability, with no integrity impact. The product is not a cloud service, and no patch or vendor advisory is provided in the data.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction to gain partial access to confidential data and cause limited disruption to availability. There is no reported impact on data integrity. No known exploits have been observed in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected application and monitor for suspicious activity related to SQL Injection attempts. Avoid exposing the vulnerable service to untrusted networks if possible.