Borg SPM 2007 contains a SQL Injection flaw that lets unauthenticated remote attackers run arbitrary SQL statements, enabling them to read, modify, and delete data stored in the database. The weakness, identified as CWE‑89, lets an attacker bypass all authentication controls and directly influence the database contents, potentially exposing sensitive information and altering system state.

The vulnerability affects Borg SPM 2007 from BorG Technology Corporation. No specific version range is listed, but the product was discontinued in 2008 and remains vulnerable.

The CVSS score is 9.3, indicating a high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely without needing credentials, making the risk persistent for any systems still running the unsupported product.