Is there a public PoC exploit available for CVE-2026-14750?

Yes, a public proof-of-concept exploit is available for CVE-2026-14750. Prioritise patching immediately. EPSS: 0.3%.

stumasy CVE-2026-14750

Q: What is the CVSS score of CVE-2026-14750?

CVE-2026-14750 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41756 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-q7w7-xc2m-gfr7

PHP SQLi Stumasy Mjperpinosa

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable SQL injection with no authentication or interaction required; partial C/I/A impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 14:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 13:46 vuln.today

DescriptionCVE.org

A security flaw has been discovered in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The affected element is the function Notes_controller::accessing_dictionary_authorization of the file application/PHP/objects/notes/accessing_dictionary_authorization.php. The manipulation of the argument Password results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in stumasy's Notes_controller grants remote unauthenticated attackers the ability to manipulate database queries through the unsanitized Password argument in the accessing_dictionary_authorization function. The affected codebase is an obscure PHP application maintained by mjperpinosa, pinned to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be as the last known vulnerable state. Publicly available exploit code exists via a GitHub issue report, and the project maintainer has not responded to disclosure, leaving no vendor-released patch at time of analysis.

Technical ContextAI

stumasy is a PHP-based application (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The vulnerable code resides in application/PHP/objects/notes/accessing_dictionary_authorization.php, within the Notes_controller::accessing_dictionary_authorization method. The Password parameter passed to this function is not sanitized or parameterized before being interpolated into an SQL query, a classic unsanitized user-input injection flaw. The CPE cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:* covers all versions, consistent with the project's rolling-release model which does not publish discrete version tags. No ORM or prepared-statement layer appears to be in use for this code path based on available data.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the responsible disclosure made via GitHub issue #6 (https://github.com/mjperpinosa/stumasy/issues/6). Organizations running stumasy should immediately apply input parameterization or prepared statements to the Notes_controller::accessing_dictionary_authorization function in application/PHP/objects/notes/accessing_dictionary_authorization.php, replacing raw string interpolation of the Password argument with PDO or MySQLi prepared statements. As a compensating control, restrict network access to the stumasy application to trusted IP ranges only, which eliminates the AV:N attack vector at the cost of reduced accessibility. Additionally, a web application firewall (WAF) rule blocking common SQL injection patterns in the Password parameter can reduce automated exploitation risk, though WAF bypass remains possible for a determined attacker. Given the lack of maintainer engagement, consider replacing or retiring this application if it is internet-facing.