CVE-2026-3745

MEDIUM

Student Web Portal 1.0 - SQL Injection

Title source: llm
STIX 2.1

Description

A vulnerability was found in code-projects Student Web Portal 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument User results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

References (6)

Core 6
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.349723
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.349723
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.767854
Various Sources product
https://code-projects.org/

Scores

CVSS v3 6.3
EPSS 0.0006
EPSS Percentile 16.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
carmelo/student_web_portal 1.0
Published Mar 08, 2026
Tracked Since Mar 08, 2026