CVE-2026-36989 describes a SQL Injection vulnerability in LuxSoft LuxCal through version 5.3.4L. The flaw is present in the rssfeed.php and common/retrieve.php scripts, allowing remote attackers to inject SQL commands without authentication. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with partial confidentiality impact but no integrity or availability impact.

An attacker can exploit this vulnerability remotely without authentication to execute SQL injection attacks, potentially exposing some confidential information from the database. There is no indication of impact on data integrity or system availability. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected scripts or applying web application firewall rules to detect and block SQL injection attempts targeting rssfeed.php and common/retrieve.php.