CVE-2026-40850
HighSummary
The getAccountData function has an SQL Injection vulnerability that can be exploited by an unauthenticated remote attacker. Improper neutralization of special elements in a SQL SELECT command leads to a total loss of confidentiality.
Risk Assessment
The organization may face serious data security breaches, leading to loss of customer trust and potential legal consequences.
Recommendation
It is recommended to implement appropriate security mechanisms, such as input validation and the use of prepared SQL statements, to minimize the risk of attack.
Original NVD description (English source)
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.