CVE-2026-37431 identifies a SQL injection vulnerability in Beauty Parlour Management System v1.1. The issue exists in the aptnumber parameter of the /appointment-detail.php endpoint, enabling attackers to manipulate SQL queries and potentially retrieve sensitive data from the backend database. The vulnerability is publicly disclosed but lacks an assigned CVSS score and any known remediation or patch information.

Successful exploitation could lead to unauthorized disclosure of sensitive database information. There is no evidence of active exploitation in the wild. The absence of a patch or mitigation means affected systems remain vulnerable until addressed by the vendor or through other protective measures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or parameterized queries as temporary mitigations if possible. Monitor for vendor updates regarding patches or official remediation.