An unauthenticated SQL Injection vulnerability (CWE-89) exists in Jetimpex Inc.'s JetEngine product in versions up to 3.8.9.1. This flaw allows attackers to inject malicious SQL commands because the application fails to properly neutralize special elements used in SQL queries. The vulnerability is remotely exploitable without authentication, with low attack complexity and no user interaction needed. It can lead to a complete confidentiality breach of the affected system's data and minor availability impact. As of the published date, no official fix or patch has been released by the vendor, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). The vulnerability does not impact integrity but has a low impact on availability. Because it is exploitable remotely without authentication, it poses a significant risk to affected systems running vulnerable versions of JetEngine.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing application-level mitigations such as web application firewalls (WAF) with SQL injection protections and restricting access to the vulnerable application where possible. Monitor vendor channels for updates and apply patches promptly once released.