Non‑relational SQL injection, also referred to as NoSQLi, is found in the Wakyma web application at the endpoint 'vets.wakyma.com/hospitalization/generate-hospitalization-summary'. The flaw allows an authenticated user to modify a POST request and inject NoSQL commands. Consequently, the attacker can retrieve sensitive customer reports, compromising the confidentiality of the data. The weakness is classified under CWE‑89 (SQL Injection) and CWE‑943 (Exploitation of NoSQL Injection).

The affected product is the Wakyma application web, as identified by the CNA. While no explicit version numbers are provided in the CNA data, the vendor notes that the vulnerability was fixed in the continuous integration deployed in production on February 19, 2026, implying that all earlier releases of this application are impacted.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score of less than 1 % suggests that exploitation is currently considered unlikely. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access, most likely through the application’s normal network interface. The impact involves unauthorized disclosure of customer reports, affecting confidentiality for any users with access to the application.