This vulnerability (CVE-2026-61969) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It affects Listdom versions <= 5.6.0 and can be exploited remotely without authentication. The CVSS 3.1 base score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and high confidentiality impact but no integrity impact and low availability impact. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited denial of service (low availability impact). The vulnerability does not affect data integrity. Because it is unauthenticated and remotely exploitable, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying workarounds such as input validation or web application firewalls to mitigate SQL injection risks. Monitor vendor channels for updates.