CVE-2026-3022
NoSQL Injection in Wakyma Endpoint Exposes Customer Reports
Publication date: 2026-03-16
Last updated on: 2026-03-19
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wakyma | wakyma | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-943 | The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know
Can you explain this vulnerability to me?
This vulnerability is a Non-relational SQL injection (NoSQLi) found in the Wakyma web application. It specifically affects the endpoint 'vets.wakyma.com/hospitalization/generate-hospitalization-summary'. An authenticated user can manipulate a POST request to this endpoint by injecting special NoSQL commands.
As a result, the attacker can exploit this injection to obtain customer reports that they should not normally have access to.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to access sensitive customer reports by injecting malicious NoSQL commands into a POST request.
Such unauthorized access to confidential information can lead to data breaches, loss of customer trust, and potential financial and reputational damage.