The vulnerability CVE-2025-54678 affects Easy Form Builder by hassantafreshi and involves improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. This allows attackers to extract sensitive data from the database without authentication. The affected versions include all versions up to 3.8.15. The CVSS 3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. Confidentiality impact is high, integrity impact is none, and availability impact is low. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database due to Blind SQL Injection. The integrity of data is not directly impacted, but availability may be slightly affected. The vulnerability is exploitable remotely without authentication or user interaction, increasing the risk of compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting Easy Form Builder. Avoid exposing the vulnerable application to untrusted networks if possible.