CVE-2026-81763: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Throws SPAM Away

This vulnerability (CVE-2026-81763) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It affects Throws SPAM Away software versions up to 3.8.2, allowing unauthenticated attackers to inject SQL commands. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level has been published as of the data provided.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and minor disruption of service (low availability impact). The vulnerability does not affect data integrity. Because the attack requires no authentication and can be performed remotely, the risk is critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable service to untrusted networks if possible.