This vulnerability (CVE-2025-30936) in Torod allows an attacker to perform SQL Injection due to improper neutralization of special elements in SQL commands. It affects Torod versions up to 2.1. The CVSS 3.1 vector indicates the attack can be performed remotely without authentication or user interaction, with a critical impact on confidentiality and limited impact on availability. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The vulnerability does not impact data integrity but may cause limited availability disruption. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing application-layer input validation and use of parameterized queries or prepared statements as temporary mitigations to reduce risk.