The vulnerability CVE-2025-22799 affects vertim Neon Product Designer (up to version 2.2.0) and is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. The CVSS 3.1 score is 8.5 (high), with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact is a partial confidentiality breach and low availability impact, with no integrity impact. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially exposing sensitive data (confidentiality impact) and causing limited disruption to service availability. Integrity of data is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected product and monitor for unusual database activity. Avoid exposing the vulnerable component to untrusted networks where possible.