This vulnerability is a non‑relational SQL injection (NoSQLi) in the Wakyma web application, targeting the endpoint 'vets.wakyma.com/pets/print-tags'. An attacker who is authenticated can modify a POST request to inject NoSQL commands, resulting in the ability to list pets and owner names. The core weakness is reflected in CWE-89 and CWE-943, indicating improper handling of user input within NoSQL queries, which leads directly to unauthorized data disclosure.

Affected system: Wakyma application web. No specific revision or version information is supplied; all deployed instances of the application web are potentially vulnerable. The entry references several CPE strings that match the Wakyma product line, but no granularity is provided.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1%, showing a low probability of exploitation in the current field. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user, after which they can perform a crafted POST request to the vulnerable endpoint. Attackers would need valid session credentials and access to the web interface; no remote unauthenticated vector is described.