CVE-2025-32287 describes an SQL Injection vulnerability in LambertGroup's Responsive HTML5 Audio Player PRO With Playlist (versions up to 3.5.7). The issue is due to improper neutralization of special elements in SQL commands, which can be exploited by an attacker with network access and low privileges without user interaction. The vulnerability has a CVSS 3.1 base score of 8.5, reflecting high impact on confidentiality and some impact on availability. No official patch or vendor advisory has been provided yet, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized SQL commands, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to service availability. Integrity impact is not indicated. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks.