Is there a public PoC exploit available for CVE-2026-14700?

Yes, a public proof-of-concept exploit is available for CVE-2026-14700. Prioritise patching immediately. EPSS: 0.3%.

Internship Management System CVE-2026-14700

Q: What is the CVSS score of CVE-2026-14700?

CVE-2026-14700 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41719 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-m5mg-5h67-mgmr

PHP SQLi Internship Management System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Unauthenticated network-accessible login endpoint; no scope change; partial C/I/A impact consistent with auth bypass and limited data exposure rather than full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 05:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 04:53 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in code-projects Internship Management System 1.0. The impacted element is an unknown function of the file employer/login.php of the component Employer Login Endpoint. The manipulation of the argument email/password leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Internship Management System 1.0 permits unauthenticated remote attackers to manipulate the email and password parameters of employer/login.php, altering backend SQL query logic to bypass authentication or partially expose database contents. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the skill threshold for exploitation. The CVSS 4.0 score of 6.9 with PR:N and no attack complexity reflects straightforward unauthenticated access, though impact is bounded at Low across confidentiality, integrity, and availability - suggesting partial rather than full database compromise.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) in a PHP web application. Per CPE cpe:2.3:a:code-projects:internship_management_system:*:*:*:*:*:*:*:*, the affected component is the employer-facing authentication endpoint at employer/login.php, where user-supplied POST parameters (email and/or password) are concatenated into SQL queries without parameterization or adequate escaping. This allows an attacker to inject arbitrary SQL syntax, altering query logic. The PHP stack and direct string interpolation into queries is a historically common pattern in academic and small-scale PHP applications distributed by code-projects.org.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix is to refactor employer/login.php to use parameterized queries or prepared statements (e.g., PDO or MySQLi with bound parameters) rather than string-interpolated SQL, eliminating the injection surface entirely. As immediate compensating controls: restrict the employer/login.php endpoint to known IP ranges via web server ACLs or firewall rules if the application is not required to be publicly accessible; deploy a web application firewall rule to block common SQL injection payloads (e.g., single quotes, UNION, OR 1=1 patterns) in login form fields - this reduces risk but is bypassable with encoding techniques; and enforce strict input validation (email format checking, length limits) as defense-in-depth. Organizations should evaluate whether continued use of this unsupported product is operationally justified given the absence of a patch.