CVE-2026-62117: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Dmitry V. Barcode Scanner with Inventory & Order Manager

This vulnerability (CVE-2026-62117) is classified as CWE-89, indicating improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. It affects the Barcode Scanner with Inventory & Order Manager product by Dmitry V. in versions up to 1.13.1. The CVSS 3.1 base score is 8.5, reflecting a network attack vector, low attack complexity, requiring low privileges and no user interaction, with scope changed. The impact includes high confidentiality impact and low availability impact, but no integrity impact. There is no vendor advisory or patch information available in the provided data.

An attacker with network access and low privileges can exploit this SQL Injection vulnerability without user interaction. The exploitation can lead to a partial denial of service and compromise confidentiality of data. Integrity is not impacted according to the CVSS vector. No known exploits in the wild are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict network access to the affected service and monitor for unusual database activity. Avoid exposing the vulnerable application to untrusted networks until a patch is available.