EUVD-2026-21891
GHSA-83p9-7gqh-59qj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend malicious HTTP request with SQL payload
-
DeliveryParse ID parameter unsafely
-
ExploitConcatenate into SQL query
-
ExecutionExecute modified query on database
-
PersistExfiltrate or modify sensitive records
-
ImpactAchieve unauthorized data access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 4.0 score of 6.9 with CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N vector indicates a remotely exploitable vulnerability requiring no user interaction or authentication (PR:N), with low attack complexity. The E:P tag confirms publicly available proof-of-concept code exists, substantially increasing real-world exploitation probability. SSVC analysis: exploitation status is confirmed public (not active KEV but PoC available), the attack is automatable (SQL injection with simple string concatenation), and technical impact is limited to low confidentiality and integrity breach (VC:L/VI:L/VA:L with no scope expansion). While the CVSS score is in the medium-high range, the low technical impact suggests data exfiltration or modification of non-critical records rather than system takeover. Real-world priority depends on data sensitivity and whether Faculty Management System handles sensitive student/faculty personally identifiable information; if so, this is a practical business risk despite the moderate CVSS rating. |
| Exploit ScenarioDerived | An unauthenticated attacker navigates to the Faculty Management System and crafts a malicious URL with SQL injection payload in the ID parameter, such as /subject-print.php?ID=1' UNION SELECT user(), database(), version()--. The application concatenates this input directly into a SQL query without escaping, causing the injected UNION clause to execute. The attacker exfiltrates database metadata, credentials, or sensitive student/faculty records visible in the query results. Using publicly available PoC code from GitHub (https://github.com/wfcht-sy/src/issues/1), this attack takes minutes to weaponize and requires only network access and a web browser. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
SQL injection in code-projects Faculty Management System 1.0 via the ID parameter in /subject-print.php allows unauthenticated remote attackers to execute arbitrary SQL queries and exfiltrate or modify database contents with low confidentiality and integrity impact. Publicly available exploit code exists, creating immediate operational risk for organizations running this system.
RemediationAI
Immediate action required: upgrade to a patched version of code-projects Faculty Management System (specific patched version not confirmed from available data; check code-projects.org advisory at https://code-projects.org/ for the latest release). The primary fix is input validation and parameterized queries: replace all dynamic SQL construction in /subject-print.php with prepared statements using bound parameters. Until a vendor patch is released, implement a Web Application Firewall (WAF) rule to block requests containing SQL metacharacters (single quotes, double dashes, UNION, SELECT, etc.) in the ID parameter. Additionally, apply principle of least privilege to the database account used by the application to restrict what queries can modify or extract. Review VulDB submission at https://vuldb.com/submit/797098 for detailed technical remediation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-89 (SQL Injection), a classic input validation failure where user-supplied data (the ID parameter) is concatenated into SQL queries without proper parameterization or escaping. The affected product is code-projects Faculty Management System (CPE: cpe:2.3:a:code-projects:faculty_management_system:*:*:*:*:*:*:*:*), a PHP-based web application. The /subject-print.php endpoint directly processes the ID parameter and passes it to database operations, allowing attackers to inject SQL metacharacters and alter query logic. This is a fundamental web application flaw that bypasses SQL parsing boundaries when dynamic query construction is used instead of prepared statements.
Know when Faculty Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in code-projects Faculty Management System 1.0. Impacted is an unknown function of the file /subject-print.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Faculty Management System
View allA vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Rat
A vulnerability classified as problematic was found in code-projects Faculty Management System 1.0. Rated medium severit
A flaw has been found in code-projects Faculty Management System 1.0. Rated low severity (CVSS 2.0), this vulnerability
A vulnerability was found in code-projects Faculty Management System 1.0 and classified as critical.php. Rated medium se
Exploit-DB