This vulnerability (CVE-2025-7636) involves improper neutralization of special elements used in SQL commands (CWE-89) in the ZEUS PDKS product from Ergosis Security Systems Computer Industry and Trade Inc. Versions before 1.0.5.10 are affected. The issue allows SQL Injection attacks that can lead to high impact on confidentiality, integrity, and availability, as indicated by the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vendor was contacted but did not provide a response or patch. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system's database, including unauthorized disclosure, modification, or deletion of data, and potential disruption of service. The CVSS score reflects high impact on confidentiality, integrity, and availability. Since the vulnerability requires low privileges and no user interaction, it poses a significant risk if an attacker can access the system with limited credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, organizations should consider implementing application-layer input validation and parameterized queries as temporary mitigations to reduce SQL Injection risk. Monitor for unusual database activity and restrict access privileges where possible until an official fix is released.