CVE-2025-28873 describes an improper neutralization of special elements in SQL commands within the Scott Taylor Shuffle product, resulting in a Blind SQL Injection vulnerability. This affects versions up to and including 0.5. The vulnerability allows an attacker with network access and low privileges to execute crafted SQL commands that can disclose sensitive information (high confidentiality impact) without requiring user interaction. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity. No patch or vendor advisory is currently available, and the product is not a cloud service.

An attacker with low privileges and network access can exploit this vulnerability to perform Blind SQL Injection attacks, potentially exposing sensitive data (high confidentiality impact). The integrity impact is none, and availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected application and apply any recommended configuration changes from the vendor. Monitor official channels for updates and apply patches promptly once released.