Is there a public PoC exploit available for CVE-2026-14701?

Yes, a public proof-of-concept exploit is available for CVE-2026-14701. Prioritise patching immediately. EPSS: 0.2%.

Internship Management System CVE-2026-14701

Q: What is the CVSS score of CVE-2026-14701?

CVE-2026-14701 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41720 LOW

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-458c-q8ch-6ghf

PHP SQLi Internship Management System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint requires a low-privilege authenticated session (PR:L); partial CIA impact scoped to the application database with no scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 05, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 05:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 05, 2026 - 04:53 vuln.today

DescriptionCVE.org

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/change_password.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Internship Management System 1.0 exposes authenticated employer accounts to database query manipulation via the Current parameter in the password change endpoint (employer/details/change_password.php). The flaw carries a CVSS 4.0 score of 5.3, is rooted in unsanitized PHP input passed directly into SQL queries (CWE-89), and has a publicly available proof-of-concept exploit on GitHub. No public exploit identified as confirmed in CISA KEV, but the combination of low attack complexity and public PoC meaningfully raises real-world exploitation likelihood against any internet-exposed deployment.

Technical ContextAI

The affected application is a PHP-based web application distributed by code-projects.org, identified by CPE cpe:2.3:a:code-projects:internship_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection pattern arising from the absence of parameterized queries or prepared statements when handling the Current (current password) argument in the POST body of employer/details/change_password.php. In typical PHP codebases of this type, the input is concatenated directly into a SQL string (e.g., WHERE password = '$_POST[Current]') without escaping, allowing an attacker to inject arbitrary SQL syntax that alters query logic and interacts directly with the underlying relational database.

RemediationAI

No vendor-released patch has been identified at time of analysis - patch status is unconfirmed from available data. The primary fix is a source-code change: replace dynamic SQL string concatenation in employer/details/change_password.php with parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), which eliminates the injection surface at the root cause. As an interim compensating control, restrict network access to the application to trusted internal networks or a VPN, preventing unauthenticated internet actors from reaching the login layer and thereby raising the effective bar for exploitation. Deploying a Web Application Firewall with SQL injection rulesets (e.g., OWASP ModSecurity CRS) can detect and block common injection patterns but is bypassable and should not substitute for the code fix. The public PoC is documented at https://github.com/zzzxc643/CVE1/blob/main/assessment/vul8.md and should be reviewed to confirm the exact injection syntax when validating any remediation. The VulDB entry is at https://vuldb.com/vuln/376297.