CVE-2026-39493

CriticalCVSS 9.3

Published: 15/06/2026(UTC)Updated: 15/06/2026(UTC)Translated: 16/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile — higher than 28% of all known CVEs

There is an unauthenticated SQL injection vulnerability in Simply Schedule Appointments versions up to 1.6.9.27.

An attacker could exploit this vulnerability to gain access to sensitive data in the application's database.

It is recommended to update to the latest version of the application to mitigate this vulnerability.

Original NVD description (English source)

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.