This vulnerability in LambertGroup's Chameleon HTML5 Audio Player With/Without Playlist (versions up to 3.5.6) involves improper neutralization of special elements in SQL commands, resulting in SQL Injection. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability loss. No known exploits in the wild or vendor patch information are currently provided.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands remotely, potentially leading to disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.