This vulnerability (CVE-2026-54822) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. It affects SALESmanago & Leadoo products up to version 3.11.2. The issue allows an attacker with low privileges and no user interaction to execute crafted SQL commands that can compromise confidentiality and cause limited availability impact. The CVSS 3.1 base score is 8.5, reflecting a high-severity risk. No patch or official remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to unauthorized disclosure of sensitive subscriber data (high confidentiality impact) and limited denial of service (low availability impact). Integrity impact is not indicated. The vulnerability requires network access and low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the affected application components and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable interface to untrusted networks if possible.