This vulnerability involves an SQL injection flaw in the mjperpinosa stumasy product, specifically in the Notes_controller::search_scratch_data function. Manipulating the field_name parameter can lead to injection of malicious SQL commands. The product is delivered via a rolling release, preventing clear versioning of affected or patched releases. The vendor has not yet responded or issued a fix. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 score of 5.3 (medium severity). Public exploit code is available, increasing the risk of attack.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. The vulnerability has low vector complexity and requires no user interaction, increasing its risk. However, the impact is rated medium due to limited privileges and partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restricting access to the vulnerable function or applying application-level input validation and sanitization on the field_name parameter may reduce risk.