The vulnerability is an Improper Neutralization of Special Elements used in an SQL Command, known as SQL injection, in Signum Technology Promotion and Training Inc.'s Windesk.Fm. The flaw allows attackers to inject arbitrary SQL statements into a query, potentially leading to unauthorized database access, disclosure of sensitive information, or modification of data. This weakness is categorized as CWE-89.

Windesk.Fm versions prior to 2.3.4 are affected. The product is supplied by Signum Technology Promotion and Training Inc.

The CVSS score of 9.8 highlights a critical risk, while the EPSS score of less than 1% indicates a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the web interface where user-supplied input is incorporated into SQL queries without proper sanitization. An attacker could abuse this to read, modify, or delete data in the underlying database if the database user has sufficient privileges.