CVE-2026-110895: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in DevItems Support Genix

This vulnerability in DevItems Support Genix support-genix-lite is caused by improper neutralization of special elements used in SQL commands, leading to SQL Injection. It affects all versions from initial release through 1.4.54. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No known exploits in the wild or vendor patch information are provided.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands remotely, potentially leading to disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). Integrity impact is not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected application to trusted users and networks, and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts specific to Support Genix.