The M A Vinoth Kumar Frontend Dashboard up to version 2.2.5 contains an SQL Injection vulnerability (CVE-2025-46248) due to improper neutralization of special elements in SQL commands. This allows remote attackers to inject SQL code without requiring privileges or user interaction, potentially leading to a complete confidentiality breach and limited availability impact. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands, resulting in a complete loss of confidentiality of the backend database. Integrity is not impacted, and availability impact is low. This could lead to unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying any available workarounds or mitigations recommended by the vendor. Monitor official channels for updates and avoid exposing vulnerable instances to untrusted networks.