CVE-2026-14750 describes a SQL injection vulnerability in the mjperpinosa stumasy product, specifically in the Notes_controller::accessing_dictionary_authorization function located in application/PHP/objects/notes/accessing_dictionary_authorization.php. The vulnerability arises from improper handling of the Password argument, which can be manipulated remotely to perform SQL injection. The product follows a rolling release model, so no fixed or affected version identifiers are provided. The vendor has been notified but has not issued a patch or official remediation. A public exploit exists, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to perform SQL injection via the Password parameter. This can lead to unauthorized data access or modification with low complexity and no required privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), reflecting the potential for partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor for official updates. In the meantime, consider implementing web application firewalls or input validation controls to mitigate SQL injection risks related to the Password parameter.