CVE-2026-84768: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in e4jvikwp VikAppointments Services Booking Calendar

This vulnerability (CVE-2026-84768) is an unauthenticated SQL Injection in VikAppointments Services Booking Calendar software versions <= 1.2.20. It is classified under CWE-89, indicating improper neutralization of special elements in SQL commands. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is currently provided.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database without authentication, leading to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability affects the confidentiality and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the vulnerable application and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the affected versions publicly if possible.