CVE-2026-42712: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in QODE Qode Tours

This vulnerability (CVE-2026-42712) is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. It affects Qode Tours software versions up to and including 3.1.3.2. The vulnerability allows an attacker with low privileges and no user interaction to execute SQL commands that can compromise data confidentiality (high impact) and cause limited availability issues (low impact). The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and partial confidentiality impact without integrity impact.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction. The impact includes a high confidentiality breach, potentially exposing sensitive subscriber data, and a low impact on availability. There is no integrity impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's communications for updates. Until a patch is available, restrict access to the affected functionality and apply any recommended workarounds from the vendor.