This vulnerability (CVE-2026-65546) in Qode Tours involves improper neutralization of special elements used in an SQL command (CWE-89), enabling unauthenticated attackers to perform SQL Injection attacks. The affected versions are all versions up to and including 3.1.3.1. The CVSS 3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). The vulnerability does not impact integrity according to the CVSS vector. Since the vulnerability is exploitable remotely without authentication, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing web application firewalls or other network-level protections to detect and block SQL injection attempts targeting Qode Tours. Monitor for updates from the vendor regarding patches or official mitigations.