CVE-2026-28002 describes a SQL Injection vulnerability in Arraytics Booktics, affecting versions up to 1.0.22. The vulnerability is due to improper neutralization of special elements used in SQL commands, enabling blind SQL injection attacks. The CVSS 3.1 score is 8.5 (High), with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact is high confidentiality loss, no integrity loss, and low availability impact. No official patch or remediation information is provided in the available data.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection attacks, potentially exposing sensitive data (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited denial of service (low availability impact). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to SQL injection attempts.