PowerJob versions 5.1.0 through 5.1.2 contain an SQL injection vulnerability in the powerjob-server component, specifically in an unspecified function of InstanceController.java that processes the 'customQuery' parameter. This allows unauthenticated remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 4.0 base score of 6.9, reflecting medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official remediation or patch has been released, and the vendor has not responded to the initial report.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database of affected PowerJob instances. This may lead to unauthorized data disclosure, data modification, or other impacts depending on the database privileges of the application. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing temporary mitigations such as restricting access to the affected endpoints, employing web application firewalls with SQL injection detection, or disabling the vulnerable functionality if feasible until an official fix is released.