A critical SQL injection vulnerability (CVE-2025-56385) affects WellSky Harmony version 4.1.0.2.83 in the login functionality at the 'xmHarmony.asp' endpoint. The 'TXTUSERID' parameter does not properly sanitize user input, allowing attackers to manipulate SQL queries. This can lead to authentication bypass, data leakage, or full compromise of the backend database.