This vulnerability in Cozy Vision SMS Alert Order Notifications (<= 3.8.1) is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. The weakness allows remote attackers to execute arbitrary SQL code, potentially exposing sensitive data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow remote attackers to read sensitive information from the database, compromising confidentiality. Integrity is not impacted, and availability impact is low. The vulnerability is exploitable without authentication or user interaction, increasing risk. However, no active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or SQL query parameterization as temporary mitigations if feasible. Monitor Cozy Vision's official channels for updates and patches.