This vulnerability in vertim Neon Product Designer (up to version 2.2.0) is caused by improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch links are provided, and the product is not a cloud service, so remediation depends on vendor patch release.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact). Integrity is not impacted, and availability impact is low. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the affected plugin or disabling it if possible. Monitor official vertim communications for updates on fixes.