CVE-2026-32479: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in CODEPRESS IT Solutions LLC Visitor Traffic Real Time Statistics Pro

This vulnerability (CVE-2026-32479) involves improper neutralization of special elements used in an SQL command (CWE-89) in the Visitor Traffic Real Time Statistics Pro product by CODEPRESS IT Solutions LLC. It affects versions up to 11.17 and allows unauthenticated attackers to perform SQL Injection attacks. The CVSS 3.1 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch available at this time.

An unauthenticated attacker can exploit this SQL Injection vulnerability to access or disclose sensitive information from the backend database, resulting in a high confidentiality impact. The vulnerability does not affect data integrity but may cause limited denial of service conditions. The critical CVSS score reflects the ease of exploitation and potential impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls or other SQL Injection detection/prevention mechanisms as temporary mitigations.