This vulnerability (CVE-2025-69094) is an instance of CWE-89 SQL Injection in ThemeMove Unicamp software, specifically affecting subscriber-related SQL commands. The flaw allows an attacker with network access and low privileges to inject SQL commands due to improper sanitization of input. The CVSS 3.1 score of 8.5 reflects high severity with network attack vector, low attack complexity, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, but no integrity loss. No vendor advisory or patch information is currently provided.

Successful exploitation could lead to unauthorized disclosure of sensitive subscriber data (confidentiality impact is high). The availability impact is low, meaning the system may experience some disruption but not complete denial of service. Integrity is not affected. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation in network-exposed environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, monitor ThemeMove's advisories for updates. Until a patch is released, consider restricting network access to the affected application and applying any available workarounds recommended by the vendor.