This vulnerability (CVE-2025-39479) affects smartiolabs Smart Notification versions up to 10.3 and is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). It enables Blind SQL Injection attacks, allowing an attacker to extract information from the backend database by injecting malicious SQL queries. The CVSS 3.1 base score is 9.3, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation guidance is currently provided by the vendor, and the product is not a cloud service.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database due to Blind SQL Injection. The vulnerability does not directly impact data integrity but can cause limited availability impact. The high CVSS score indicates a critical risk to confidentiality if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any available workarounds or input validation controls to mitigate SQL injection risks. Monitor vendor channels for updates and apply patches promptly once released.