A critical SQL Injection vulnerability exists in Crowd Favorite DXP ToolKit up to version 2.0.1. This flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a high CVSS score of 9.3, indicating network exploitable with no privileges or user interaction required, and can cause high confidentiality impact and low availability impact.