Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows… (CVE-2026-112822)

CVE-2026-112822 describes an improper neutralization of special elements used in an SQL command (SQL Injection) vulnerability in AmentoTech Workreap Core. Specifically, the workreap_core component allows blind SQL injection attacks. The affected versions are all versions before 3.4.4, although exact affected versions were not explicitly enumerated. The CVSS 3.1 base score is 8.5, indicating a high severity vulnerability with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No known exploits in the wild or patch links were provided.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to perform blind SQL injection attacks. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). There is no reported impact on data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor the vendor's announcements for updates and apply any official fixes once available. Until then, consider restricting database access and applying input validation or web application firewall rules to mitigate potential exploitation.