This vulnerability, identified as CVE-2026-24552 and categorized under CWE-89, involves improper neutralization of special elements used in SQL commands within the Create product by John-Michael L'Allier. It allows an attacker with low privileges and no user interaction to perform Blind SQL Injection remotely over a network. The vulnerability affects all versions up to and including 2.5.3. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, and partial confidentiality and availability impacts. No known exploits are reported in the wild, and no official remediation or patch has been disclosed yet.

The vulnerability allows an attacker to perform Blind SQL Injection, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to availability (low availability impact). Integrity impact is not affected. The attack requires low privileges and no user interaction, increasing the risk of exploitation over a network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any recommended workarounds from the vendor and restrict access to the affected application to trusted users only.