This vulnerability involves improper neutralization of special elements in SQL commands within Nelio Content, enabling blind SQL injection attacks. It affects all versions up to 4.2.0. The CVSS 3.1 score is 8.5, reflecting a network attack vector with low attack complexity, requiring low privileges and no user interaction. The impact is high on confidentiality, with no integrity impact and low impact on availability. No vendor advisory or patch information is currently available.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection, potentially exposing sensitive data (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited availability issues. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.