CVE-2025-68865 describes an SQL Injection vulnerability in Infility Global (versions up to 2.15.06) caused by improper neutralization of special elements in SQL commands. This allows remote attackers to execute unauthorized SQL queries without authentication or user interaction. The vulnerability is rated critical with a CVSS 3.1 score of 9.3, reflecting its ease of exploitation and potential for high confidentiality impact. No patch or official remediation guidance is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability enables remote attackers to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). Integrity is not impacted, and availability impact is low. No known exploits have been reported in the wild. The vulnerability affects all versions of Infility Global up to and including 2.15.06.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Infility's advisories closely. Until a fix is available, consider restricting access to the affected application and applying any available compensating controls recommended by the vendor once disclosed.