Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics that allows SQL Injection. This issue affects Booktics through version 1.0.29.
An unauthenticated attacker over the network can execute arbitrary SQL queries to extract sensitive data from the database and cause denial of service through resource-intensive queries.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Upgrade Arraytics Booktics to a version beyond 1.0.29. Implement input validation and parameterized queries to prevent SQL injection attacks. Deploy web application firewall rules to detect and block SQL injection attempts. Restrict database user permissions to follow the principle of least privilege.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
NVD published the first details for CVE-2026-109894
A CVSS base score of 9.3 has been assigned.
Feedly found the first article mentioning CVE-2026-109894 . See article
GitHub Advisories released a security advisory .
[GHSA-g983-7v69-7xgc] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2026-109894 - Exploits & Severity - Feedly
CVE-2026-110372: OttoKit suretriggers Privilege Escalation Enables Administrative Control
CVE-2026-109894: Arraytics Booktics SQL Injection Enables Data Exfiltration and Database Manipulation
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL… (CVE-2026-109894)
[GHSA-g983-7v69-7xgc] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
