Is there a public PoC exploit available for CVE-2026-15137?

Yes, a public proof-of-concept exploit is available for CVE-2026-15137. Prioritise patching immediately. EPSS: 0.3%.

Interview Management System CVE-2026-15137

Q: What is the CVSS score of CVE-2026-15137?

CVE-2026-15137 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42493 MEDIUM

SQL Injection (CWE-89)

2026-07-09 VulDB

GHSA-cj35-237p-x6j7

PHP SQLi Interview Management System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated SQLi with no scope change; partial CIA impact aligned with data-layer access, not OS-level compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 00:27 vuln.today

CVSS changed

Jul 09, 2026 - 00:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Interview Management System 1.0 exposes the application to remote, unauthenticated database manipulation via the ID parameter in /inc/classes/View.php. An attacker with network access can read, modify, or partially disrupt data stored in the underlying database with no authentication required and no user interaction needed. A public exploit exists (referenced via GitHub at https://github.com/susususua-AI/CVE/issues/2), though no active exploitation has been confirmed by CISA KEV as of this analysis.

Technical ContextAI

Interview Management System 1.0 is a PHP-based web application distributed by code-projects.org, identified by CPE cpe:2.3:a:code-projects:interview_management_system:*:*:*:*:*:*:*:*. The wildcard version in the CPE suggests the issue may span multiple releases, though 1.0 is specifically documented. The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command): the application fails to sanitize or parameterize the ID argument before incorporating it into a SQL query within /inc/classes/View.php. This is a classic PHP SQLi pattern - likely direct string concatenation rather than use of PDO prepared statements or equivalent parameterized query mechanisms - allowing attacker-controlled SQL syntax to alter query logic.

RemediationAI

No vendor-released patch has been identified at time of analysis. Code-projects.org does not maintain a formal security advisory process based on available references. Developers should immediately replace direct SQL string construction in /inc/classes/View.php with parameterized queries using PHP PDO prepared statements or MySQLi bound parameters - this eliminates the root cause. As compensating controls pending a code fix, administrators should restrict external network access to the Interview Management System using firewall rules or reverse proxy ACLs, and deploy a web application firewall (WAF) rule blocking SQL metacharacters (single quotes, comment sequences, UNION/SELECT keywords) in the ID parameter - note that WAF rules add maintenance overhead and may cause false positives on legitimate IDs. If the application is not actively required, taking it offline entirely is the lowest-risk mitigation. Reference: https://vuldb.com/vuln/376952.