The vulnerability CVE-2025-31531 affects the History Log by click5 plugin (versions up to 1.0.13) and is caused by improper neutralization of special elements in SQL commands, resulting in SQL Injection. This allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially compromising data confidentiality and causing partial service disruption. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the affected system without authentication. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). There is no indication of integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.