CVE-2026-39764

An unauthenticated SQL injection vulnerability exists in Radius Booking's Booking Calendar for Appointments & Services versions 1.0.19 and earlier, allowing attackers to execute arbitrary SQL queries on the database. This critical flaw can lead to unauthorized data access and manipulation, posing significant risks to the integrity and confidentiality of sensitive information. Organizations using affected versions should prioritize immediate remediation to mitigate potential exploitation.