This vulnerability in TeconceTheme Saasplate Core (<= 1.2.8) arises from improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. The flaw allows remote attackers to send crafted requests that can manipulate backend SQL queries without authentication or user interaction, potentially exposing sensitive data. The CVSS 3.1 score of 9.3 reflects critical severity with network attack vector, low attack complexity, no privileges required, and significant confidentiality impact.

Successful exploitation could lead to unauthorized disclosure of sensitive information from the database due to Blind SQL Injection. The integrity impact is not indicated, and availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended temporary mitigations from the vendor or restrict access to the affected service to trusted networks. Monitor vendor channels for updates.