The vulnerability CVE-2025-69180 affects themepassion Ultra Portfolio (versions <= 6.7) and is caused by improper neutralization of special elements in SQL commands, resulting in Blind SQL Injection. This allows an attacker with network access and low privileges to inject SQL commands without user interaction, potentially compromising the confidentiality of the database. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and partial impact on confidentiality and availability.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and may cause limited disruption to availability. Integrity impact is not indicated. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected application and monitor for suspicious activity related to SQL injection attempts.