CVE-2026-111402: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Tribulant Software Newsletters

This vulnerability in Tribulant Software Newsletters (newsletters-lite) versions prior to 4.18.2 is caused by improper neutralization of special elements used in SQL commands, leading to SQL Injection. An attacker can exploit this flaw remotely without authentication or user interaction to execute arbitrary SQL commands, potentially exposing sensitive data. The CVSS 3.1 score of 9.3 reflects the critical nature of this vulnerability with high confidentiality impact and low availability impact. The vulnerability is publicly disclosed but no vendor advisory or patch information is available in the provided data.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information. The vulnerability does not require privileges or user interaction, increasing its risk. The impact on confidentiality is high, while integrity is not impacted and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected application and monitoring for suspicious activity related to SQL injection attempts.