Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system… (CVE-2026-105889)

CVE-2026-105889 describes an improper neutralization of special elements used in an SQL command (SQL Injection) vulnerability in Tickera's tickera-event-ticketing-system. The vulnerability allows blind SQL injection attacks, which can be exploited remotely without authentication. The affected versions include all versions up to and including 3.6.0.6. The CVSS 3.1 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and partial denial of service (low availability impact). The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, consider restricting access to the affected system and monitoring for suspicious activity related to SQL injection attempts.