Varient 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user_id parameter. Attackers can submit POST requests with crafted SQL payloads in the user_id field to bypass authentication and extract sensitive database information. The weakness is identified as CWE‑89. The CVSS score of 8.8 reflects a high severity risk to confidentiality and integrity of the database contents.

The affected product is Varient:Varient SQL Inj. Version 1.6.1 is listed in the vendor information. No additional affected versions are provided in the input, so the scope is limited to this release.

The low EPSS score (<1%) indicates that the probability of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, the high CVSS score demonstrates that if exploited, the impact would be significant. Attackers can exploit this flaw by sending crafted POST requests to the vulnerable endpoint without any authentication, making it easily reachable by unauthenticated users.