This vulnerability (CVE-2026-5134) is an SQL injection flaw in Loca Software Informatics Technology Ltd. Co. CMS caused by improper neutralization of special elements used in SQL commands (CWE-89). It affects all versions of the CMS up to and including 06082026. The flaw allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to full compromise of the database. The vendor was contacted but did not respond, and no patch or remediation has been published. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to complete compromise of the CMS database, including unauthorized data disclosure, data modification, and potential denial of service. The vulnerability is remotely exploitable without authentication, making it highly dangerous. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying temporary mitigations such as input validation, web application firewalls, or restricting database permissions until an official fix is released.