A SQL injection vulnerability (CVE-2026-90708) affects Yot CMS versions 3.3.0 and 3.3.1. The issue is located in the Login function of the global.php file in the Cookie Handler component. Remote attackers can exploit this by manipulating the yot3_user or yot3_pass arguments, enabling SQL injection attacks. The vulnerability is publicly known and exploitable remotely. No patch or remediation information is provided in the input data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The CVSS score of 6.9 indicates a medium severity impact. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable login function or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the yot3_user and yot3_pass parameters.