UBB.threads is vulnerable to a blind SQL Injection that allows an attacker with access to the Members in Control Panel to manipulate SQL queries by exploiting insufficient input sanitization. Through time‑based or boolean‑based techniques, an attacker can extract sensitive information, such as user credentials, from the underlying database. The weakness is classified as CWE‑89 and can result in a significant compromise of confidentiality.

The vulnerability has been confirmed in UBB Systems’ UBB.threads version 7.7.5 and may affect other released versions of the same product. No additional vendors or variants are known to be impacted.

The CVSS score of 8.6 marks this flaw as high severity. Although an EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the potential for credential theft and data exposure is significant. The likely attack vector requires authenticated access to the Members section of the Control Panel, implying that internal or privileged users may be able to exploit it. Due to the high impact, the risk of exploitation remains considerable until a vendor patch is released and deployed.