CVE-2025-63939 is an SQL injection vulnerability in the anirudhkannan Grocery Store Management System 1.0. It arises from improper input handling of the sitem_name POST parameter in the /Grocery/search_products_itname.php script. The vulnerability allows unauthenticated remote attackers to inject and execute arbitrary SQL queries, affecting the confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 9.8 (critical), with attack vector network, no privileges required, and no user interaction needed. No vendor patch or remediation level is currently documented.

Successful exploitation can lead to complete compromise of the affected system, including unauthorized data disclosure, data modification, or deletion. The vulnerability affects confidentiality, integrity, and availability with a critical severity rating. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries as a temporary mitigation to prevent SQL injection. Monitor vendor channels for updates and apply patches promptly once released.