CVE-2026-73365 is an unauthenticated SQL Injection vulnerability in JetAppointment, a product by Crocoblock and Jetimpex Inc. The vulnerability affects all versions up to and including 2.5.2. It allows an attacker to inject malicious SQL commands without requiring any privileges or user interaction, leading to potential compromise of confidential data and partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope change with high confidentiality impact and low availability impact. No patch or official remediation level has been published yet.

An attacker can exploit this vulnerability remotely without authentication to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability poses a critical risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls or other SQL injection mitigations as temporary measures. Monitor vendor communications for updates on patches or official mitigations.