The vulnerability is an SQL injection that allows attackers to run arbitrary SQL commands in the context of the current user. This can lead to arbitrary code execution, potentially giving the attacker elevated access or full control over the application. The flaw arises from improper neutralization of special elements in the SQL command, identified as CWE‑89.

Adobe Campaign Classic is affected. Version information was not disclosed in the advisory, so any installation of the product is potentially vulnerable.

The CVSS score of 10 indicates maximum severity. Based on the description, the likely attack vector is remote via a network request to a vulnerable endpoint, as exploitation does not require user interaction. No EPSS score is available, making the actual exploitation probability uncertain, but the high CVSS combined with the lack of user interaction means this may be a high‑priority risk. The vulnerability is not listed in the CISA KEV catalog, but that does not lessen its risk. Attackers can send malicious payloads to the affected component, potentially without authentication, depending on the exposure of the endpoint. The scope of the vulnerability is changed, allowing the attacker to gain higher privilege than the currently authenticated user.