CVE-2026-42722: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Shabti Kaplan Frontend Admin by DynamiApps

This vulnerability (CVE-2026-42722) is an SQL Injection flaw in Frontend Admin by DynamiApps, specifically in versions up to 3.29.13. It arises from improper neutralization of special elements used in SQL commands (CWE-89), allowing an attacker with high privileges to inject malicious SQL code. The CVSS 3.1 score is 7.6, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No known exploits in the wild or vendor patch information is available at this time.

An attacker with high privileges can exploit this SQL Injection vulnerability to access or exfiltrate sensitive data from the database, compromising confidentiality. The vulnerability does not affect data integrity but may cause limited denial of service. The attack can be performed remotely over the network without user interaction, increasing risk in exposed environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application to trusted administrators only and monitor for suspicious database activity. Avoid exposing the vulnerable versions publicly.