This vulnerability in Picture-Planet GmbH Verowa Connect (<= 3.0.5) allows an attacker with high privileges to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. The issue can lead to partial confidentiality compromise and limited availability impact. The CVSS v3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and scope change. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation can lead to unauthorized disclosure of information from the database (confidentiality impact) and limited denial of service (availability impact). Integrity is not affected. The attack requires high privileges, which limits the attack surface. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and monitor for suspicious database activity related to SQL injection attempts. Avoid exposing vulnerable versions to untrusted networks.