This vulnerability (CVE-2025-27268) affects enituretechnology's Small Package Quotes – Worldwide Express Edition (up to version 5.2.18) and is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. The vulnerability allows an unauthenticated attacker to inject SQL commands, potentially compromising sensitive data. No patch or official remediation guidance is currently available, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure of sensitive information. The CVSS score indicates a critical impact on confidentiality and a minor impact on availability. There are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor enituretechnology's advisories for updates. Until a fix is available, consider restricting access to the affected application and applying any available web application firewall (WAF) rules to detect and block SQL injection attempts.