CVE-2026-96809: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MultiNet Interactive AB EduAdmin Booking

CVE-2026-96809 describes an SQL Injection vulnerability in EduAdmin Booking by MultiNet Interactive AB. The flaw arises from improper neutralization of special elements used in SQL commands, enabling Blind SQL Injection attacks. This vulnerability affects versions from initial releases up to but not including 6.0.0. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to extract sensitive information from the backend database through Blind SQL Injection. The confidentiality impact is high, potentially exposing sensitive data. Integrity is not impacted, and availability impact is low. There are no known exploits in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation and parameterized queries as temporary mitigations if possible.