CVE-2026-95610: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in UpSolution UpSolution Core

This vulnerability in UpSolution Core involves improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. The flaw allows an attacker with network access and low privileges to execute crafted SQL queries that can compromise data confidentiality. The affected versions are all releases prior to 9.3.1. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact with low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive data due to blind SQL injection. The integrity of data is not impacted, and availability impact is low. There are no known exploits in the wild as of the publication date.

No explicit patch or remediation details are provided in the input data. The affected versions are prior to 9.3.1, implying that upgrading to version 9.3.1 or later may address the issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.