CVE-2026-6148

HIGH

code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

References (5)

Scores

CVSS v3 7.3
EPSS 0.0004
EPSS Percentile 11.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
code-projects/Vehicle Showroom Management System 1.0
Published Apr 13, 2026
Tracked Since Apr 13, 2026