The vulnerability is an SQL injection that allows an attacker to inject arbitrary SQL through the 'query' parameter in the search functionality. Because the application does not properly sanitise or parameterise user input, an unauthenticated user can submit multiple GET or POST requests to the /search endpoint and retrieve hidden data. The impact is the unprivileged ability to read sensitive database tables and potentially other confidential information, thereby compromising data confidentiality.

This flaw affects the Mediasoftpro ASP.NET jVideo Kit version 1.0. The product is used for video sharing and includes a search feature that directly reflects user input to the database query. No other versions are mentioned as affected; therefore version 1.0 is considered fully vulnerable.

The CVSS score of 8.8 indicates a high severity, reflecting the remote, unauthenticated nature of the attack and the high potential impact on confidentiality. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests limited, but still significant exposure. Attackers can exploit the flaw over standard HTTP(s) traffic, with no special privileges required, making it possible for anyone with internet access to compromise the database.