Key detail from vendor description: "XooDigital Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'p' parameter." Attackers can send GET requests to results.php with malicious 'p' values to extract sensitive database information. The vulnerability is classified under CWE-89 (SQL Injection) and carries a CVSS score of 8.8, indicating high severity and the potential for significant confidentiality loss.

Known affected vendor/product: Xooscripts XooDigital (source: CNAs vendor list). No specific version information is supplied, so all installations of XooDigital may be vulnerable unless a later patch has been applied.

Key detail from scores: EPSS Score < 1% suggests low current exploit probability, and the vulnerability is not listed in CISA’s KEV catalog, indicating no widely known exploitation. Based on the description, the likely attack vector is remote via HTTP access to results.php and requires no authentication. The high CVSS score, combined with the possibility of data exfiltration, results in significant risk to affected systems.