CVE-2025-32128 describes an SQL Injection vulnerability in the aaronfrey Nearby Locations product (versions <= 1.1.1). The issue is caused by improper neutralization of special elements in SQL commands, which can be exploited to manipulate SQL queries. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patches or vendor advisories are currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to cause unauthorized disclosure of confidential information due to SQL Injection. Integrity is not impacted, but availability impact is low. The vulnerability could lead to data exposure or leakage within the affected Nearby Locations application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently available, users should monitor vendor communications for updates. Until a fix is released, restricting access to the affected application and limiting privileges may reduce risk.