The vulnerability CVE-2025-69338 affects don-themes Riode Core up to version 1.6.26 and involves improper neutralization of special elements in SQL commands, leading to Blind SQL Injection. This allows remote attackers to extract sensitive information from the database without authentication or user interaction. The CVSS 3.1 base score is 9.3, reflecting critical severity with network attack vector, low attack complexity, and significant confidentiality impact. No vendor advisory or patch links are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform Blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive database information. The confidentiality impact is high, while integrity is not affected and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for unusual database activity. Avoid exposing the vulnerable component to untrusted networks if possible.