CVE-2026-6490

CVE-2026-6490 is a SQL injection vulnerability affecting QueryMine SMS up to commit 7ab5a9ea196209611134525ffc18de25c57d9593, specifically within the admin/deletecourse.php file's GET request parameter handler. The flaw exists in the ID parameter, which fails to properly sanitize user input before database queries. Due to QueryMine's rolling release model, specific affected version numbers are not available, complicating patch identification for end users. The vulnerability carries a HIGH severity rating of 7.3 on the CVSS scale and can be exploited remotely without authentication or user interaction required. Attack complexity is low, meaning exploitation does not require specialized conditions or techniques. The compromise could result in unauthorized data access, data modification, and potential service disruption, affecting the confidentiality, integrity, and availability of the application. Public exploit code has been released, significantly increasing the risk of active exploitation in the wild. The vulnerability is currently listed on security hotlists and requires immediate attention despite the low EPSS score. The vendor has been notified but did not respond, leaving organizations dependent on self-remediation or community-provided patches until an official update is released.