CVE-2026-27413 is an SQL Injection vulnerability (CWE-89) in Cozmoslabs Profile Builder Pro prior to version 3.14.0. It allows an unauthenticated attacker to perform Blind SQL Injection attacks remotely over the network, potentially leading to unauthorized disclosure of sensitive information and partial denial of service. The vulnerability arises from improper neutralization of special elements in SQL commands. The CVSS 3.1 base score is 9.3, reflecting critical impact on confidentiality and some impact on availability, with no required privileges or user interaction.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive data from the backend database (high confidentiality impact) and partial denial of service (low availability impact). The attacker does not require authentication or user interaction, increasing the risk of remote exploitation. There is no indication of integrity impact. No known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users of Cozmoslabs Profile Builder Pro should monitor vendor communications for updates and apply patches once available. Until then, consider restricting network access to the affected application and applying web application firewall rules to detect and block SQL injection attempts if possible.