CVE-2026-66593: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in CleanTalk Inc Security & Malware scan by CleanTalk

CVE-2026-66593 is an unauthenticated SQL Injection vulnerability (CWE-89) in Security & Malware scan by CleanTalk versions up to 2.184. This vulnerability allows remote attackers to inject SQL commands without any authentication, potentially compromising the confidentiality of the database and causing partial availability loss. The CVSS v3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthenticated remote attackers to perform SQL Injection attacks, which can lead to high confidentiality impact by exposing sensitive data. The integrity impact is not indicated, but availability impact is low, possibly causing some service disruption. The vulnerability affects the confidentiality of the system's data and could be exploited to extract sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the affected application and monitoring for suspicious activity related to SQL injection attempts.