This vulnerability in Song-Li cross_browser up to commit ca690f0fe6954fd9bcda36d071b68ed8682a786a involves improper sanitization of the ID parameter in the flask/uniquemachine_app.py file's details endpoint, leading to SQL injection. The flaw allows remote attackers to inject SQL commands by manipulating the ID argument. The product's rolling release model obscures version-specific details. The vendor has not issued any advisory or patch, and the vulnerability is publicly disclosed with potential exploit availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database with limited confidentiality, integrity, and availability impact as indicated by the CVSS vector. This could lead to unauthorized data access or modification. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider applying application-level input validation or web application firewall rules to block malicious SQL injection attempts targeting the ID parameter.