CVE-2026-112822: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in AmentoTech Workreap Core

This vulnerability in AmentoTech Workreap Core (versions >=0 and <3.4.4) is due to improper neutralization of special elements used in SQL commands, leading to a blind SQL injection flaw. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with low privileges to perform blind SQL injection attacks remotely, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to SQL injection attempts.