Adobe Campaign Classic is vulnerable to a classic SQL injection flaw that allows a low‑privileged attacker to execute arbitrary code in the context of the current user. The flaw arises from improper neutralization of special elements used in an SQL command, where user supplied data can be injected directly into a query. Because the vulnerability is not limited to a single user or session, a successful exploitation changes the scope of the compromise and can affect the entire application configuration.

The affected product is Adobe Campaign Classic from Adobe. No specific affected versions are listed in the CNA data, so any deployment of Adobe Campaign Classic that has not applied the latest patch may be vulnerable.

The CVSS score of 9.9 indicates critical severity. EPSS is not available, but the flaw does not require user interaction, implying that a remote attacker can trigger the exploit from outside the application. The change in scope means that a successful attack can elevate privileges or affect multiple users. The vulnerability is not listed in the CISA KEV catalog at present. The CVE does not specify an attack vector; it is inferred that the vulnerability could be exploited where untrusted input is accepted by the application, but this inference is not supported by explicit evidence in the CVE data.