CVE-2026-5198

HIGH

code-projects Student Membership System Admin Login index.php sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

References (5)

Scores

CVSS v3 7.3
EPSS 0.0001
EPSS Percentile 2.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
code-projects/Student Membership System 1.0
Published Mar 31, 2026
Tracked Since Mar 31, 2026