So planning is vulnerable to multiple SQL injections across several endpoints that accept user‑supplied parameters. An attacker with low privileges can inject arbitrary SQL commands, which may allow data theft, modification, or even full control over the database, compromising confidentiality, integrity, and availability. The flaw falls under CWE‑89, where improper sanitization of inputs permits malicious database queries.

This issue affects the SOPlanning application from the SOPlanning vendor, specifically all releases version 1.55 and older. The CVE entry does not list any other affected builds, so any deployment of those or earlier minor revisions remains vulnerable.

The CVSS score of 8.7 categorises the vulnerability as high risk, and the lack of a listed KEV suggests no confirmed public exploits yet, though the exploit probability is currently unknown. Based on the description, the attack vector is likely via exposed web endpoints that accept user input; an authenticated user with low privileges could exploit the injection flaws to gain database access. The potential impact is significant, warranting urgent remediation.