This vulnerability (CVE-2026-65546) is an SQL Injection issue in Qode Tours software versions <= 3.1.3.1. It allows unauthenticated attackers to inject special SQL elements due to improper neutralization, classified under CWE-89. The CVSS 3.1 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). The vulnerability does not impact data integrity. Since no privileges or user interaction are required, the attack surface is broad, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing application-level input validation and web application firewall (WAF) rules to detect and block SQL injection attempts targeting Qode Tours. Monitor vendor channels for updates.