This vulnerability (CVE-2025-23779) in web-mv ResAds (versions <= 2.0.5) is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 7.6 (high), with attack vector network, low attack complexity, requiring high privileges, no user interaction, and scope changed. The impact affects confidentiality (high) and availability (low), but not integrity. No known exploits in the wild or vendor patches are currently documented.

An attacker with high privileges can exploit this SQL Injection vulnerability to potentially access sensitive data (confidentiality impact is high) and cause limited denial of service (availability impact is low). Integrity is not impacted. Since exploitation requires high privileges, the threat is somewhat limited to privileged users or compromised accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided at this time. Until a fix is available, restrict high-privilege access to the affected ResAds versions and monitor for suspicious activity related to SQL injection attempts.