CVE-2026-42414: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in CridioStudio ListingPro

CVE-2026-42414 is an SQL Injection vulnerability (CWE-89) in CridioStudio's ListingPro product, affecting versions up to 2.9.12. The flaw arises from improper neutralization of special elements used in SQL commands within the subscriber feature, enabling an attacker with low privileges and no user interaction to execute SQL commands remotely. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, and partial confidentiality and availability impacts.

An attacker with low privileges can exploit this vulnerability remotely to execute SQL commands, potentially leading to partial confidentiality compromise of the database and limited availability issues. There is no indication of integrity impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided. Until a patch is available, restrict access to vulnerable components and monitor for suspicious activity related to SQL injection attempts.