CVE-2026-105076: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Appsbd Vitepos

This vulnerability involves improper neutralization of special elements in SQL commands within Appsbd Vitepos vitepos-lite, enabling blind SQL injection attacks. The flaw affects all versions prior to 3.6.2, allowing attackers with high privileges to exploit the vulnerability remotely without user interaction. The CVSS 3.1 score is 7.6, indicating high severity with network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact reported.

An attacker with high privileges can exploit this vulnerability remotely to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). There is no reported impact on data integrity. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict high privilege access and apply any recommended workarounds from the vendor.