This vulnerability involves improper neutralization of special elements in SQL commands within the Quiz And Survey Master plugin by ExpressTech Systems, allowing SQL Injection attacks. It affects all versions up to 10.3.1. The CVSS score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact is a complete confidentiality breach with limited availability impact. No known exploits in the wild or vendor patch information is currently available.

Successful exploitation could allow an attacker to execute unauthorized SQL commands, leading to disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability requires low privileges but no user interaction, increasing the risk in environments where users have some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin and monitoring for unusual database activity. Avoid exposing the vulnerable component to untrusted networks or users with low privileges.