The vulnerability CVE-2026-31922 affects Ays Pro Fox LMS (versions up to 1.0.6.3) and is caused by improper neutralization of special elements in SQL commands, leading to Blind SQL Injection. This allows an attacker with low privileges to send crafted requests over the network to manipulate SQL queries, potentially exposing sensitive data (confidentiality impact is high) without requiring user interaction. The attack does not affect data integrity but may cause a low impact on availability. No known exploits are reported in the wild, and no patch or vendor advisory details are available.

An attacker with network access and low privileges can exploit this vulnerability to perform Blind SQL Injection attacks, potentially exposing sensitive information from the database (high confidentiality impact). The integrity of the data is not affected, but availability may be slightly impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected application and monitoring for unusual database query patterns related to SQL injection attempts.