EUVD-2026-21875
GHSA-gcjq-vfr8-9cjw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /addcat.php
-
DeliveryInject SQL syntax in cata parameter
-
ExploitDatabase executes concatenated malicious query
-
ExecutionAttacker extracts sensitive data or modifies records
-
ImpactGain unauthorized access to application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 4.0 vector confirms this is a network-exploitable vulnerability requiring no authentication (PR:N), no special user interaction (UI:N), and minimal attack complexity (AC:L), yielding a base score of 6.9 with low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L). The CVSS assessment indicates partial data access, not full system compromise. However, exploitation probability is marked as present (E:P), and publicly available exploit code significantly lowers the barrier to attack. The real-world risk is elevated because SQL injection in PHP-based admin/catalog management functions often exposes sensitive user data and enables lateral privilege escalation; however, the bounded impact rating suggests the vulnerability affects a non-critical data scope or has some mitigating factors (e.g., limited database permissions). This is a genuine priority for environments running Lost and Found Thing Management 1.0, but not a critical infrastructure threat. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTTP POST or GET request to the /addcat.php endpoint with a specially formed cata parameter containing SQL metacharacters and a UNION-based injection payload (e.g., cata=test' UNION SELECT user(),version()--). The unfiltered input reaches the database query, allowing the attacker to extract usernames, password hashes, or other sensitive data from the database, or potentially escalate to arbitrary file read/write if database functions permit. Publicly available exploit code from GitHub lowers the technical barrier, making this accessible to script-kiddie-level attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
SQL injection in Lost and Found Thing Management 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the cata parameter in /addcat.php. The vulnerability has CVSS 6.9 (network-accessible, low complexity) and publicly available exploit code exists, making it a practical attack vector for data exfiltration and manipulation in this PHP-based application.
RemediationAI
Upgrade Lost and Found Thing Management to a patched version if released by code-projects; check https://code-projects.org/ for updates. As an immediate workaround, implement input validation and parameterized SQL queries in /addcat.php to sanitize the cata parameter, using prepared statements (e.g., mysqli_prepare or PDO with bound parameters) instead of string concatenation. Additionally, apply web application firewall rules to block SQL keywords and special characters in the cata parameter, and restrict database user permissions to the minimum required for the application's function. Consult VulDB (https://vuldb.com/vuln/357052) for additional remediation context and proof of concept details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Lost and Found Thing Management is a PHP web application that handles item cataloging and retrieval. The vulnerability is a classic SQL injection flaw (CWE-89) in the /addcat.php endpoint, where user-supplied input in the cata parameter is insufficiently sanitized before being incorporated into SQL queries. The application fails to use prepared statements or parameterized queries, allowing attackers to inject arbitrary SQL syntax that the database interprets as command logic rather than literal data. This is a server-side vulnerability in the application's database interaction layer, affected by the presence of string concatenation in SQL query construction without proper escaping or binding.
Know when Lost And Found Thing Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in code-projects Lost and Found Thing Management 1.0. This affects an unknown part of the file /addcat.php. Performing a manipulation of the argument cata results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB