CVE-2025-28959 is an SQL Injection vulnerability in the Md Yeasin Ul Haider URL Shortener (up to version 3.0.7) caused by improper neutralization of special elements in SQL commands within the exact-links feature. This allows remote attackers to execute SQL commands without authentication or user interaction, potentially leading to unauthorized data disclosure. The vulnerability has a CVSS 3.1 base score of 9.3, reflecting critical severity with high confidentiality impact and low availability impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

The vulnerability enables remote attackers to perform SQL Injection attacks without authentication or user interaction, potentially exposing sensitive data due to high confidentiality impact. There is no reported impact on data integrity, and availability impact is low. Exploitation could compromise the confidentiality of the backend database used by the URL Shortener application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a patch is available, consider restricting access to the vulnerable component or applying web application firewall (WAF) rules to detect and block SQL Injection attempts targeting the exact-links feature.