This vulnerability (CVE-2025-6918) affects Ncvav Virtual PBX Software prior to version 09.07.2025 and is classified as CWE-89 (SQL Injection). It allows attackers to inject malicious SQL commands due to improper sanitization of input used in SQL queries. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no patch or fix details are available from the vendor or other sources. The product is not a cloud service, so remediation depends on vendor patching or user updates.

Successful exploitation of this vulnerability can result in complete compromise of the affected Virtual PBX system, including unauthorized data disclosure, data modification, and denial of service. The high CVSS score indicates critical impact with no required privileges or user interaction, making it highly exploitable remotely. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected software and monitor for unusual activity. Avoid exposing the Virtual PBX interface to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.