This vulnerability in ovatheme Cube Portfolio (versions <= 1.16.8) involves improper neutralization of special elements used in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 8.5 (high), with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact is a confidentiality breach and partial availability loss. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker to inject SQL commands, potentially leading to unauthorized access to sensitive data (confidentiality impact) and partial disruption of service (availability impact). Integrity impact is not indicated. The vulnerability requires low privileges but no user interaction, making it a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the vulnerable component and monitor for unusual database activity. No official fix or temporary workaround has been documented at this time.