This vulnerability in pakkemx Pakke Envíos (versions up to 1.0.2) allows SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. The impact affects confidentiality (high) and availability (low) but not integrity. No official patch or vendor advisory is provided in the available data.

Successful exploitation could allow an attacker with low privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the affected application to trusted users and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable version to untrusted networks.