Is there a public PoC exploit available for CVE-2026-5666?

Yes, a public proof-of-concept exploit is available for CVE-2026-5666. Prioritise patching immediately. EPSS: 0.0%.

Online Fir System CVE-2026-5666

Q: What is the CVSS score of CVE-2026-5666?

CVE-2026-5666 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19364 MEDIUM

Insecure Storage of Sensitive Information (CWE-922)

2026-04-06 VulDB

GHSA-jhff-3rr5-hh56

Information Disclosure Online Fir System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 16:00 euvd

EUVD-2026-19364

Analysis Generated

Apr 06, 2026 - 16:00 vuln.today

CVE Published

Apr 06, 2026 - 15:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the component SQL Database Backup File Handler. The manipulation results in insecure storage of sensitive information. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

Code-Projects Online FIR System 1.0 stores sensitive database backup files insecurely, allowing unauthenticated remote attackers to access the /complaints.sql backup file and disclose confidential information. The CVSS 5.5 score reflects low confidentiality impact but network-accessible exposure; publicly available exploit code exists, elevating practical risk despite the moderate score.

Technical ContextAI

The Online FIR System (First Information Report management software) fails to properly protect SQL database backup files, specifically /complaints.sql. This falls under CWE-922 (Insecure Storage of Sensitive Information), a weakness in data protection controls. The SQL backup file is accessible via the HTTP/HTTPS network interface without authentication (PR:N per CVSS vector), allowing attackers to retrieve unencrypted or inadequately protected database dumps. The affected product is identified by CPE cpe:2.3:a:code-projects:online_fir_system:*:*:*:*:*:*:*:*, indicating all versions of this product line are potentially vulnerable. Database backup files typically contain plaintext database credentials, user accounts, hashed or plaintext passwords, and operational data-precisely the information an FIR (police complaint) system would contain.

RemediationAI

Immediately move or delete the /complaints.sql backup file from the web-accessible directory and restrict database backup file storage to non-web-accessible locations with appropriate filesystem permissions. Apply any security patches released by Code-Projects (check https://code-projects.org/ for patch availability and version updates). As an interim measure, implement authentication controls or IP-based access restrictions on database backup files using web server configuration (.htaccess for Apache, nginx location blocks, etc.), and ensure backup files are encrypted at rest and never stored in the web root. If using Online FIR System 1.0, strongly consider upgrading to a newer version once available, and conduct a forensic audit of access logs to determine if the /complaints.sql file was previously accessed.