The vulnerability CVE-2025-69366 affects TeconceTheme Emerce Core (versions up to 1.8) and is caused by improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. This allows remote attackers to extract sensitive information from the database without authentication or user interaction. The CVSS 3.1 base score is 9.3, indicating critical severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is high on confidentiality, none on integrity, and low on availability. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

An attacker can exploit this vulnerability remotely without authentication to perform Blind SQL Injection, potentially exposing sensitive database information (high confidentiality impact). Integrity is not affected, and availability impact is low. This could lead to data leakage or unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or web application firewall (WAF) rules to detect and block SQL injection attempts specific to this product. Monitor vendor channels for updates and patches.