CVE-2026-23805 describes an SQL Injection vulnerability in Yoren Chang Media Search Enhanced (versions up to 0.9.1). This vulnerability arises from improper neutralization of special elements in SQL commands, allowing an attacker with high privileges to potentially impact the confidentiality of the database. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No patch or official remediation guidance is currently available from the vendor, and no exploits are known in the wild.

Successful exploitation could allow an attacker with high privileges to execute crafted SQL commands that compromise the confidentiality of the database. The vulnerability does not directly impact integrity or availability significantly but poses a high risk to sensitive data exposure. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to trusted users with high privileges and applying defense-in-depth controls around database access may reduce risk.