This vulnerability involves improper neutralization of special elements in SQL commands within the Stefano Lissa Newsletter software, enabling blind SQL injection attacks. It affects all versions up to 9.0.9. The CVSS score of 7.6 reflects a high severity with network attack vector, low attack complexity, and requiring high privileges. The impact is primarily on confidentiality with some availability impact, and no integrity impact is noted. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

An attacker with high privileges can exploit this vulnerability remotely to perform blind SQL injection, potentially exposing sensitive data (confidentiality impact) and causing limited disruption to service availability. There is no indication of integrity compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to the affected software and monitor for unusual activity. Avoid exposing the affected service to untrusted networks where possible.