Online Notes Sharing System CVE-2026-4540

Remote unauthenticated SQL injection against projectworlds Online Notes Sharing System 1.0. Attack targets /login.php parameter 'Benutzer'. No special configuration required; default installations are vulnerable. No victim interaction needed.

The real-world risk is significant and immediate. The CVSS 7.3 score reflects network-based exploitation (AV:N) with low attack complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), enabling straightforward remote attacks. The presence of a public exploit on GitHub (E:P - Proof-of-concept available) dramatically increases risk, as attackers can leverage existing code without developing their own. The CVSS vector indicates partial impact across confidentiality, integrity, and availability (C:L/I:L/A:L), meaning attackers can read sensitive data, modify records, and potentially disrupt service. While no EPSS score is provided and the vulnerability is not in CISA's KEV catalog, the combination of public exploit availability, zero authentication requirements, and targeting of an authentication mechanism makes this a high-priority issue for organizations running this software. The attack is fully automatable, and the login page is typically exposed to the internet, making it trivial for attackers to discover and exploit vulnerable instances.

An attacker identifies an internet-facing instance of Online Notes Sharing System 1.0 through automated scanning or search engine reconnaissance. Using the publicly available GitHub proof-of-concept at https://github.com/juzidddd/CVE/issues/4, they craft a malicious HTTP request to /login.php with SQL injection payloads in the 'Benutzer' parameter, such as admin' OR '1'='1' -- to bypass authentication or UNION-based queries to extract the entire user database including credentials, personal information, and potentially uploaded notes. The low attack complexity and network accessibility allow mass exploitation across multiple vulnerable instances with minimal effort.