CVE-2026-65546

An unauthenticated SQL injection vulnerability exists in Qode Tours versions up to 3.1.3.1, allowing attackers to execute arbitrary SQL commands on the database. This critical flaw could lead to unauthorized data access, data manipulation, or complete system compromise. Organizations using affected versions should prioritize immediate patching to mitigate potential exploitation risks.