Amazee Ai Private Ai Provider
Monthly
SQL injection (CWE-89, base CVSS 6.5) in the amazee.ai Private AI Provider Drupal contrib module lets an attacker inject into SQL statements executed by the module's database layer, with high confidentiality impact and limited integrity impact in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Every site running the module in versions 0.0.0 through 1.3.7, or 1.4.0 through 1.4.3, is affected; exposure is bounded because this is a contrib module that most Drupal installations do not deploy. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, and EPSS is low at 0.17% (6th percentile), but the vendor has published a security advisory and a patched release, and the standard Drupal contrib upgrade path applies. Note the published CVE vector scores PR:N while the independent assessment scores PR:L, so the privilege level an attacker needs is not consistently confirmed across sources.
SQL injection (CWE-89, base CVSS 6.5) in the amazee.ai Private AI Provider Drupal contrib module lets an attacker inject into SQL statements executed by the module's database layer, with high confidentiality impact and limited integrity impact in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Every site running the module in versions 0.0.0 through 1.3.7, or 1.4.0 through 1.4.3, is affected; exposure is bounded because this is a contrib module that most Drupal installations do not deploy. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, and EPSS is low at 0.17% (6th percentile), but the vendor has published a security advisory and a patched release, and the standard Drupal contrib upgrade path applies. Note the published CVE vector scores PR:N while the independent assessment scores PR:L, so the privilege level an attacker needs is not consistently confirmed across sources.