The vulnerability CVE-2025-22540 affects seballero Emailing Subscription (up to version 1.4.1) and involves improper neutralization of special elements in SQL commands, resulting in a Blind SQL Injection. This allows an unauthenticated attacker to execute crafted SQL queries remotely, potentially exposing sensitive data. The CVSS v3.1 score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. No vendor advisory or patch information is available at this time.

An attacker can exploit this vulnerability remotely without authentication to perform Blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information from the database. The integrity impact is not indicated, and availability impact is low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing application-layer mitigations such as input validation and parameterized queries if possible. Monitor vendor communications for updates on patches or official mitigations.