The vulnerability CVE-2025-32636 in matthewrubin Local Magic is an SQL Injection issue caused by improper neutralization of special elements used in SQL commands. This allows remote attackers to inject SQL code, potentially compromising confidentiality of the database. The affected product versions are up to 2.9.0. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no privileges or user interaction, impacting confidentiality severely and availability slightly. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation could lead to unauthorized disclosure of sensitive information from the database (confidentiality impact is high). The availability impact is low, meaning the service might be disrupted but not completely denied. Integrity impact is not indicated. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected application and applying any available workarounds recommended by the vendor once disclosed.