This vulnerability in Metagauss ProfileGrid (<= 5.9.5.0) is due to improper neutralization of special elements in SQL commands, leading to SQL Injection. The flaw allows an attacker with network access and low privileges to execute crafted SQL commands that can compromise confidentiality and cause limited denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and scope change with high confidentiality impact and low availability impact.

Successful exploitation could allow an attacker to access or manipulate sensitive data in the database, impacting confidentiality. The vulnerability also results in a limited denial of service condition. Integrity impact is not indicated. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations are provided in the available data.