The vulnerability CVE-2025-30947 affects gopiplus Cool fade popup (up to version 10.1) and is caused by improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No known exploits in the wild or vendor patch information are provided.

Successful exploitation could allow an attacker to extract sensitive information from the database (high confidentiality impact) without affecting data integrity but with minor impact on availability. The attack requires low privileges and no user interaction, increasing risk. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any available workarounds or restricting access to the affected component to trusted users only. Monitor vendor channels for updates.