This vulnerability (CVE-2026-52693) involves improper neutralization of special elements used in SQL commands (CWE-89) in impleCode's eCommerce Product Catalog. It affects all versions up to and including 3.5.5. The flaw allows unauthenticated attackers to perform SQL Injection, which can result in unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). The CVSS 3.1 base score is 9.3, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the database (high confidentiality impact) and limited disruption of availability (low impact). Integrity impact is not indicated. The vulnerability can be exploited remotely without authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing application-level input validation and SQL query parameterization as temporary mitigations. Monitor vendor communications for updates on patches or official fixes.