Roxy-WI, a web interface used to manage Haproxy, Nginx, Apache and Keepalived servers, suffers from a SQL injection flaw in the haproxy_section_save function. The server_ip parameter, taken from the URL path, is passed through without sanitization and ultimately interpolated into a SQL query via Python string formatting. This flaw is a classic injection weakness (CWE‑89) that allows an attacker to execute arbitrary SQL statements, potentially leading to unauthorized data access, data modification, or further privilege escalation through the database.

The vulnerability affects all installed versions of Roxy‑WI that are older than version 8.2.6.4; the patch that removes the flaw is delivered in 8.2.6.4 and later releases.

The vulnerability carries a CVSS score of 8.9, indicating high severity, but its EPSS score is listed as less than 1%, suggesting a low probability of exploitation in the wild. It is not currently catalogued in the CISA KEV list. Based on the description, the likely attack vector is through the web interface, requiring an authenticated session with sufficient privileges to access the haproxy_section_save endpoint. The low EPSS mitigates immediate risk, yet the potential for database compromise warrants prompt remediation.