The thanhtungtnt Video List Manager product up to version 1.7 suffers from an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker with network access and low privileges to inject SQL commands without user interaction, potentially compromising confidentiality of the database and causing limited availability issues. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no required user interaction.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider restricting network access to the affected application and monitor for suspicious activity related to SQL injection attempts.