iScripts ReserveLogic includes an SQL injection vulnerability (CWE-89) that allows unauthenticated attackers to manipulate database queries through the jqSearchDestination parameter on the search endpoint. Attackers can send crafted POST requests containing SQL payloads, resulting in extraction of sensitive database information. Based on the description, it is inferred that this could lead to exposure of confidential data.

The affected vendor is iScripts with product ReserveLogic. No specific version information is disclosed in the CVE data, so all installations of this product may be vulnerable until further details are released.

The CVSS score of 8.8 indicates a high severity impact, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated POST request to the search endpoint, which is explicitly stated in the CVE description. Based on the description, it is inferred that any user with network access to the application could potentially exploit this flaw. The high score combined with the low EPSS indicates a high priority for remediation, though the low exploitation probability may allow a short window if a patch is promptly applied.