CVE-2026-14750 describes a SQL injection vulnerability in the mjperpinosa stumasy software. The vulnerable code is located in the function Notes_controller::accessing_dictionary_authorization within application/PHP/objects/notes/accessing_dictionary_authorization.php. An attacker can manipulate the Password parameter to inject SQL commands remotely. The product employs a rolling release model, and no specific affected or fixed versions have been disclosed. The vendor has not issued a response or patch as of the publication date. The CVSS 4.0 vector indicates the attack is network accessible with low complexity and no privileges or user interaction required, but with low confidentiality, integrity, and availability impact. Exploit code has been publicly released, increasing risk.

Successful exploitation allows remote attackers to perform SQL injection via the Password parameter, potentially leading to unauthorized data access or manipulation within the affected application. The CVSS score of 6.9 (medium severity) reflects that the vulnerability can be exploited remotely without authentication, but with limited impact on confidentiality, integrity, and availability. Publicly available exploit code increases the likelihood of attacks.

No official patch or remediation has been released by the vendor. Since the vendor has not responded and no fix is available, users should consider implementing application-level mitigations such as input validation and parameterized queries to prevent SQL injection. Monitor vendor channels for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.