CVE-2026-94663: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Metagauss ProfileGrid

This vulnerability involves improper neutralization of special elements in SQL commands within Metagauss ProfileGrid (profilegrid-user-profiles-groups-and-communities), enabling Blind SQL Injection attacks. It affects all versions from initial release up to but not including 6.0.0.3. The CVSS 3.1 score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity impact and low availability impact.

An attacker with low privileges can exploit this vulnerability remotely to perform Blind SQL Injection, potentially extracting sensitive data from the database (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited availability issues. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected ProfileGrid installation to trusted users and monitor for unusual database activity related to SQL injection attempts.