This vulnerability in Song-Li cross_browser up to commit ca690f0fe6954fd9bcda36d071b68ed8682a786a involves improper sanitization of the ID parameter in the details endpoint within flask/uniquemachine_app.py, leading to SQL injection. The attack can be performed remotely without authentication or user interaction. Due to the rolling release nature of the product, specific versioning information for affected or fixed releases is unavailable. The vendor has not provided any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impact, resulting in a medium severity rating.

Successful exploitation allows an attacker to perform SQL injection remotely on the affected endpoint, potentially leading to unauthorized access or manipulation of the backend database. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available from the vendor, who has not responded to the vulnerability disclosure. Users should monitor the vendor's communications for updates. Until a fix is released, consider implementing application-layer protections such as input validation, parameterized queries, or web application firewalls to mitigate SQL injection risks on the affected endpoint.