This vulnerability (CVE-2025-49267) affects the Frontend Admin by DynamiApps product, specifically versions up to 3.28.3. It arises from improper neutralization of special elements used in SQL commands, enabling blind SQL injection attacks. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, requiring low privileges and no user interaction. The impact is a complete confidentiality breach (high confidentiality impact) with no integrity impact and low availability impact. No known exploits in the wild have been reported as of the publication date.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform blind SQL injection attacks remotely, potentially leading to unauthorized disclosure of sensitive information from the database. The integrity of data is not impacted, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected component and applying compensating controls such as input validation or web application firewalls if feasible.