EUVD-2026-19223
GHSA-7rp3-m58h-6q3h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in code-projects Easy Blog Site 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in code-projects Easy Blog Site 1.0 allows unauthenticated remote attackers to compromise authentication and potentially extract, modify, or delete database contents via crafted username/password parameters in login.php. CVSS 7.3 (High) with network attack vector, low complexity, and no authentication required. Publicly available exploit code exists (GitHub POC), significantly lowering the barrier to exploitation. No vendor-released patch identified at time of analysis.
Technical ContextAI
This vulnerability affects code-projects Easy Blog Site version 1.0, a PHP-based blogging application (CPE: cpe:2.3:a:code-projects:easy_blog_site:*:*:*:*:*:*:*:*). The issue is classified as CWE-89 (SQL Injection), a critical input validation weakness where user-supplied data is directly incorporated into SQL queries without proper sanitization or parameterization. The login.php authentication handler fails to validate or escape the username and password parameters before constructing SQL statements, allowing attackers to inject arbitrary SQL commands. Classic SQL injection in authentication forms enables bypass of login mechanisms (via tautologies like ' OR '1'='1), extraction of sensitive data including password hashes, modification of user accounts or content, and potential privilege escalation to administrative access. PHP applications without prepared statements or ORM-based query building are particularly vulnerable to this class of attack.
RemediationAI
No vendor-released patch identified at time of analysis for code-projects Easy Blog Site 1.0. Primary remediation options include: (1) Immediate removal or isolation of affected Easy Blog Site 1.0 installations from network access, particularly internet-facing deployments. (2) Implementation of Web Application Firewall (WAF) rules to block SQL injection patterns targeting login.php, specifically filtering username and password POST parameters for SQL metacharacters (quotes, semicolons, comment markers, UNION keywords). (3) Code-level mitigation requires modifying login.php to use parameterized prepared statements (mysqli_prepare/PDO with bound parameters) instead of string concatenation for SQL queries. (4) Enforce principle of least privilege on database accounts used by the application, restricting permissions to minimum required operations. (5) Enable comprehensive logging of authentication attempts and SQL errors to detect exploitation attempts. Monitor vendor channels at https://code-projects.org/ and VulDB submission https://vuldb.com/submit/786150 for potential security updates. Given the likely educational/demonstration nature of this project, migration to a maintained, security-hardened CMS platform is recommended for production use cases.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today