CVE-2026-32581: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in mooberrydreams Mooberry Book Manager

CVE-2026-32581 is an SQL Injection vulnerability (CWE-89) in Mooberry Book Manager version 4.16.2. The vulnerability arises from improper neutralization of special elements used in SQL commands within subscriber-related functionality. According to the CVSS 3.1 vector, the attack requires network access, has high complexity, low privileges, no user interaction, and affects confidentiality and availability with a scope change. No known exploits are reported in the wild, and no vendor patch or advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized SQL commands, leading to a complete loss of confidentiality of the database contents and a partial loss of availability of the affected system. The attack complexity is high, and the attacker requires low privileges and network access. There is no indication of integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit network exposure of the affected version and restrict access to trusted users only.