The vulnerability CVE-2025-49378 affects Themefic Hydra Booking (up to version 1.1.10) and is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. The CVSS 3.1 score is 8.5, reflecting a network attack vector with low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (S:C), with high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The availability of the system may be slightly affected, but integrity is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply any available workarounds or mitigations provided by the vendor. Avoid exposing the affected application to untrusted networks and restrict user privileges as much as possible to reduce risk.