This vulnerability in PowerJob 5.1.x involves SQL injection via the customQuery parameter in the InstanceController.java source file. The injection occurs due to insufficient input validation or sanitization, enabling remote attackers to manipulate SQL queries executed by the application. The CVSS 4.0 score is 6.9 (medium), reflecting network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official remediation or patch is currently available, and no known exploits have been reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium, indicating some confidentiality, integrity, and availability loss but not critical system compromise. No evidence of active exploitation is known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should consider implementing temporary mitigations such as input validation or restricting access to the vulnerable endpoint until an official patch is available.