The reported flaw is a classic SQL injection (CWE‑89) located in the ‘two_steps_auth_code’ input field that the /user-login endpoint processes during two‑factor authentication. Attackers can send crafted payloads before any user is authenticated, causing arbitrary SQL statements to be executed against the database backend. Successful exploitation could give an attacker read access to all data, the ability to create or modify privileged user accounts, change or delete critical data, and even crash the service with denial‑of‑service conditions.

The vulnerability affects Nemon’s SaaS offerings, specifically Nemon Trade Energy and Nemon Trade Energy CRM. No particular version numbers are listed, which means that any instance running the affected authentication module before the fix is potentially impacted.

The risk remains high according to the CVSS score of 9.3, but the vulnerability has been fully mitigated by the vendor on 26 May 2026, and there is no documented exploitation. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, indicating no known active exploitation. Attackers would need to target the /user-login endpoint, sending malicious payloads in the two_steps_auth_code field before authentication. Because the fix has been applied centrally to all SaaS instances, typical customers need not take action beyond routine monitoring.