This vulnerability in pebas Lisfinity Core arises from improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. It affects all versions up to 1.5.0. The CVSS 3.1 vector indicates that the attack can be performed remotely without authentication or user interaction, with a scope change and high confidentiality impact but no integrity impact and low availability impact. No patch or remediation information is currently provided.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information. The CVSS vector indicates a high confidentiality impact, no integrity impact, and low availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing application-level input validation and SQL query parameterization as temporary mitigations. Monitor vendor channels for updates regarding patches or official mitigations.