This vulnerability (CVE-2026-52712) is classified as CWE-89, indicating improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. It affects tnomi Attendance Manager versions <= 0.6.2. The CVSS 3.1 base score is 7.6 (high), with an attack vector of network, low attack complexity, requiring low privileges and user interaction, and scope changed. The impact includes high confidentiality loss and low availability loss, but no integrity loss. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with network access and low privileges, requiring user interaction, could exploit this SQL Injection vulnerability to cause a complete loss of confidentiality (e.g., unauthorized data disclosure) and a partial loss of availability of the affected system. Integrity is not impacted according to the CVSS vector. This could lead to sensitive information exposure and potential service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with user inputs and consider implementing application-level input validation or web application firewalls to mitigate exploitation risks.