This vulnerability (CVE-2025-39484) in Waituk Entrada arises from improper neutralization of special elements used in SQL commands, classified under CWE-89. It affects Entrada versions up to 5.7.7 and allows an attacker to perform SQL Injection attacks remotely without authentication or user interaction. The CVSS 3.1 score of 9.3 reflects critical severity with high confidentiality impact and low availability impact. No known exploits in the wild have been reported, and no patch or vendor advisory is currently provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the affected database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity impact is not indicated, and availability impact is low. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended workarounds from the vendor and limit exposure of the affected service to untrusted networks where possible.