CVE-2026-5645

HIGH

projectworlds Car Rental System Parameter pay.php sql injection

Title source: cna
STIX 2.1

Description

A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the component Parameter Handler. Executing a manipulation of the argument mpesa can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

References (4)

Scores

CVSS v3 7.3
EPSS 0.0004
EPSS Percentile 10.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
projectworlds/Car Rental System 1.0
Published Apr 06, 2026
Tracked Since Apr 06, 2026