This vulnerability (CVE-2025-31403) in shiptrack Booking Calendar and Notification allows an attacker to exploit improper neutralization of special elements in SQL commands, resulting in Blind SQL Injection. The affected versions include all up to and including 4.0.3. The CVSS 3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to extract sensitive information from the backend database (confidentiality impact is high). The availability impact is low, and integrity is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or mitigations recommended by the vendor. Monitoring vendor channels for updates is advised.