CVE-2026-3023
Published: 16 March 2026
Summary
CVE-2026-3023 is a medium-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Wakyma Wakyma. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3023 is a non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-tags'. Published on 2026-03-16T14:19:45.663, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
The vulnerability can be exploited over the network by an authenticated user with low privileges through alteration of a POST request to the affected endpoint, enabling injection of NoSQL commands. Successful exploitation allows the attacker to list both pets and owner names, with the high CVSS impacts indicating potential for significant confidentiality, integrity, and availability compromise.
Mitigation details are available in the INCIBE-CERT advisory on multiple vulnerabilities in the Wakyma web application, accessible at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wakyma-application-web.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12395
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-tags'. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the purpose of injecting NoSQL commands, allowing them…
more
to list both pets and owner names.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
NoSQL injection in public-facing web app endpoint directly matches exploitation of public-facing applications (T1190) via crafted POST requests over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user inputs to the 'print-tags' endpoint to neutralize special elements and prevent NoSQL injection commands.
Ensures timely identification, reporting, and correction of the specific NoSQLi flaw in the Wakyma web application.
Boundary protection with web application firewalls monitors and blocks altered POST requests containing NoSQL injection payloads to the affected endpoint.