CVE-2026-3023

🗓️ 16 Mar 2026 10:12:53Reported by INCIBEType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 8 Views🌐 WEB

Authenticated user can exploit non relational injection at vets.wakyma.com/pets/print-tags to list pets and owner names.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-3023	16 Mar 202610:12	–	attackerkb
CNNVD	Wakyma 安全漏洞	16 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-3023 Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web	16 Mar 202610:12	–	cvelist
EUVD	EUVD-2026-12395	16 Mar 202615:30	–	euvd
NVD	CVE-2026-3023	16 Mar 202614:19	–	nvd
Positive Technologies	PT-2026-25672	16 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-3023	26 Mar 202615:12	–	redhatcve
Vulnrichment	CVE-2026-3023 Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web	16 Mar 202610:12	–	vulnrichment

NVD

Vulners

CNA

Node

wakyma wakymaMatch-

[
  {
    "vendor": "Wakyma",
    "product": "Wakyma application web",
    "versions": [
      {
        "status": "affected",
        "version": "all versions"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
incibe	www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wakyma-application-web

Parameter	Position	Path	Description	CWE
body	request body	vets.wakyma.com/pets/print-tags	Non-relational (NoSQL) injection vulnerability allowing authenticated users to inject NoSQL commands via the POST body to the /pets/print-tags endpoint.	CWE-943, CWE-89

17 Jun 2026 10:42Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.8

CVSS 45.3

EPSS0.00329

SSVC