This vulnerability (CVE-2025-54043) affects YayCommerce SMTP for Amazon SES (up to version 1.9) and is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 7.6 (High), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact affects confidentiality (high) and availability (low), but not integrity. No patch or official remediation details are provided, and the product is not a cloud service, so remediation responsibility lies with the user/vendor.

Successful exploitation could allow an attacker with high privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive information (confidentiality impact) and partial disruption of service (availability impact). Integrity is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor YayCommerce communications for updates. Until a fix is available, restricting access to the affected component to trusted users with minimal privileges may reduce risk.