The vulnerability CVE-2025-67517 in artplacer ArtPlacer Widget allows an attacker with low privileges to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. This affects versions up to 2.22.9.2. The CVSS 3.1 score is 8.5 (high), indicating network attack vector, low attack complexity, no user interaction, and scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No known exploits in the wild or vendor patch information are currently available.

Successful exploitation could allow an attacker to extract sensitive information from the backend database (confidentiality impact is high). The availability impact is low, meaning the attack may cause some disruption but not complete denial of service. Integrity is not impacted. The vulnerability could lead to unauthorized data disclosure through Blind SQL Injection techniques.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component to trusted users only and monitor for unusual database query patterns. Avoid exposing the vulnerable widget in untrusted environments. Do not assume the vulnerability is mitigated without vendor confirmation.