CVE-2026-39746: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in fs-code Booknetic

This vulnerability (CVE-2026-39746) in the fs-code Booknetic product is an improper neutralization of special elements used in an SQL command (CWE-89), commonly known as SQL Injection. It affects all versions of Booknetic up to 4.8.5 inclusive. The vulnerability is exploitable remotely without any authentication required. The CVSS v3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). There is no impact on data integrity. The vulnerability can be exploited remotely by unauthenticated attackers, increasing the risk of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to SQL injection attempts.