CVE-2026-42721: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SERVIT Software Solutions affiliate-toolkit

This vulnerability involves improper neutralization of special elements used in SQL commands within the affiliate-toolkit product by SERVIT Software Solutions. Specifically, it allows blind SQL injection attacks in versions up to and including 3.9.1. The CVSS 3.1 score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, high privileges required, no user interaction, and a scope change. The impact includes complete confidentiality compromise and partial availability loss, but no integrity impact is noted.

An attacker with high privileges can exploit this blind SQL injection vulnerability to extract sensitive information from the database, leading to a complete loss of confidentiality. The vulnerability also causes a partial loss of availability. Integrity is not affected according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or fix information is provided, users should monitor the vendor's official channels for updates and consider restricting high-privilege access to the affected software until a fix is available.