The flaw resides in the _execute_sql method of the Refiner Agent component of wbbeyourself MAC‑SQL. Malicious input can be injected into the SQL query, allowing an attacker to manipulate database commands. This vulnerability directly leads to unauthorized data modification or retrieval, potentially exposing sensitive information or disrupting database integrity. The associated weaknesses are represented by CWE‑89 (SQL Injection) and CWE‑74 (HTML Injection).

All installations of wbbeyourself MAC‑SQL up to the commit 31a9df5e0d520be4769be57a4b9022e5e34a14f4 are susceptible. The product follows a rolling release model, so affected versions are identified only by the last known compromised commit, and no specific release is listed as fixed.

The CVSS score of 5.3 indicates moderate severity, yet the attack is remotely exploitable and publicly available, raising the risk profile. EPSS data is missing, but the presence of a public exploit suggests a higher likelihood of real‑world attacks. The vulnerability is not listed in CISA’s KEV catalog, yet the combination of remote access and unauthenticated injection presents a significant threat if left unmitigated.