This vulnerability (CVE-2025-11253) in Netty ERP is due to improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It affects all versions before 1.1000 and allows remote attackers to execute arbitrary SQL code without authentication, given the network attack vector and no required privileges or user interaction. The CVSS 3.1 base score is 9.8, reflecting critical severity with impacts on confidentiality, integrity, and availability. No patch or official remediation has been disclosed, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database of Netty ERP, potentially leading to full compromise of the database including data disclosure, modification, or deletion, and disruption of service. The critical CVSS score reflects the high risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds from the vendor or restrict network access to the affected application to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.