This vulnerability (CVE-2025-58628) in kamleshyadav Miraculous versions before 2.0.9 is caused by improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. The CVSS 3.1 score of 9.3 reflects that the vulnerability is remotely exploitable without privileges or user interaction, with a significant confidentiality impact and limited availability impact. No patch or official fix information is available at this time, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform Blind SQL Injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity impact is not indicated, and availability impact is low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the affected application and applying any recommended workarounds from the vendor once published. Monitor official channels for updates.