A flaw in Song‑Li cross_browser allows a remote actor to manipulate the ID argument supplied to the Details Endpoint in flask/uniquemachine_app.py. By injecting specially crafted SQL into this parameter, an attacker can cause the server to execute arbitrary SQL statements against the underlying database, potentially reading, modifying, or deleting records. The vulnerability is classified as an SQL injection (CWE‑89) and is further compounded by a lack of input validation (CWE‑74).

The flaw affects all releases of Song‑Li cross_browser up to commit ca690f0fe6954fd9bcda36d071b68ed8682a786a. Because the product follows a rolling release model, precise version identifiers are not available. Any currently deployed instance that has not applied an undisclosed fix remains vulnerable. The vendor has not responded to the disclosure, so no official patch is available as of the time of reporting.

The CVSS score of 6.9 indicates a moderate severity level, while the absence of an EPSS score and exclusion from CISA’s KEV catalog suggest the attack is not already widespread. Nevertheless, the exploitation path is straightforward: a remote user sends an HTTP request with a malicious ID payload; if the application fails to sanitize the input, the injected SQL is executed against the database. The attacker could obtain confidential data, alter application state, or erase critical records. Because the vendor has not released a fix and does not appear to acknowledge the vulnerability, the risk remains high for any exposed instance.