CVE-2025-15688 is an unauthenticated SQL Injection vulnerability (CWE-89) in ThemeGoods Capella, affecting versions up to 2.5.5. The vulnerability allows remote attackers to inject SQL commands without any authentication, resulting in a critical severity with a CVSS 3.1 score of 9.3. The impact includes high confidentiality compromise and low availability impact, with no integrity impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability enables unauthenticated remote attackers to execute arbitrary SQL commands on the affected Capella installations, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). There is no reported impact on data integrity. The critical CVSS score reflects the ease of exploitation and the severity of confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations and monitor for suspicious activity. Avoid exposing the affected application to untrusted networks where possible.