This vulnerability (CVE-2026-57687) is an instance of CWE-89, improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. It affects the Custom Field Template software versions up to 2.7.8. An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute arbitrary SQL commands, resulting in a high confidentiality impact and limited availability impact. The CVSS v3.1 base score is 8.5, reflecting the severity of the issue. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The attack requires low privileges and no user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates and apply any patches once available. Until then, consider restricting access to the affected application components and reviewing input validation controls to mitigate potential exploitation.