This vulnerability is a NoSQL injection flaw identified in the Wakyma application web. An authenticated user can manipulate the GET request to the endpoint vets.wakyma.com/centro/equipo/empleado, inserting special NoSQL commands. The flaw allows enumeration of sensitive employee data, leading to a breach of confidentiality. The underlying weakness maps to CWE‑89 (SQL injection) and CWE‑943 (Improper Neutralization of NoSQL Injection).

Wakyma’s Wakyma application web is affected. All versions running the vulnerable endpoint are at risk until the vendor’s patch was applied. Wakyma stated that the continuous integration deployed in production since February 19 2026 includes the fix. The product does not list individual version numbers, so any deployment before that date remains vulnerable.

The CVSS score of 7.1 indicates a high risk to confidentiality and integrity. The EPSS score lower than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not yet included in the CISA KEV catalog. Exploitation requires valid authentication and network access to the web endpoint, so an attacker who can gain access to the application’s infrastructure or compromised user credentials could enumerate sensitive records.