CVE-2026-7731

MEDIUM

code-projects BloodBank Managing System get_state.php sql injection

Title source: cna

Description

A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. The affected element is an unknown function of the file get_state.php. The manipulation of the argument G_STATE_ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-360906 | code-projects BloodBank Managing System get_state.php sql injection

https://vuldb.com/vuln/360906

Signature, Permissions Required signature permissions-required

VDB-360906 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/360906/cti

Third Party Advisory third-party-advisory

Submit #807557 | Code-projects BLOODBANK MANAGING SYSTEM IN PHP 1.0 SQL injection

https://vuldb.com/submit/807557

Exploit exploit

https://github.com/QAp89/CVE/blob/main/SQL3.md

View Exploit ZIP pw:eip

Product product

https://code-projects.org/

Scores

CVSS v3 6.3

EPSS 0.0003

EPSS Percentile 9.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-89

Status published

Products (1)

code-projects/BloodBank Managing System 1.0

Published May 04, 2026

Tracked Since May 04, 2026