CVE-2026-96809

CriticalCVSS 9.3

Published: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Summary

The EduAdmin Booking plugin (eduadmin-booking) by MultiNet Interactive AB contains an SQL Injection vulnerability (improper neutralization of special elements in SQL commands). It allows an attacker to perform blind SQL injection. This issue affects versions from n/a before 6.0.0.

Risk Assessment

An attacker could execute unauthorized database queries, potentially reading, modifying, or deleting data. This may lead to leakage of booking information, customer data, or full database compromise.

Recommendation

Update the EduAdmin Booking plugin to version 6.0.0 or later. Check for any unauthorized database access.

Other vulnerabilities in EduAdmin Booking

CVE-2026-62101Critical
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. The description does not provide technical details of the exploitation mechanism.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS