EUVD-2026-21980
GHSA-225p-6j6c-7793
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed /web/admin/login.php endpoint
-
DeliveryObtain public POC from GitHub
-
ExploitCraft SQL injection payload
-
ExecutionSubmit malicious User parameter
-
PersistBypass authentication query logic
-
ImpactAccess admin panel or extract data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible, unauthenticated, low-complexity exploitation-a high-risk posture. However, the impact scores (VC:L/VI:L/VA:L) suggest limited confidentiality, integrity, and availability consequences, which moderates the overall score to 6.9. The presence of publicly available exploit code (POC) elevates practical risk significantly beyond the baseline score; attackers have weaponizable tools ready for deployment. The CVSS E:P flag confirms exploit maturity. This is not a critical RCE or total system compromise, but rather a targeted authentication bypass with controlled data access; nevertheless, the combination of public POC, unauthenticated access, and low attack complexity makes it a priority for immediate patching in internet-facing instances. Organizations running Simple CMS 1.0 publicly should treat this as urgent despite the 6.9 score. |
| Exploit ScenarioDerived | An attacker identifies a publicly accessible instance of Simple CMS 1.0 and navigates to the login page at /web/admin/login.php. Using the publicly available exploit code from GitHub, the attacker crafts a malicious SQL payload (e.g., ' OR '1'='1) in the User parameter and submits the login form. The unvalidated input is directly interpolated into the authentication query, allowing the attacker to bypass login credentials and gain unauthorized access to the admin panel or extract sensitive database records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
SQL injection in code-projects Simple Content Management System 1.0 allows unauthenticated remote attackers to manipulate the User parameter in /web/admin/login.php, enabling database query manipulation with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, increasing real-world attack likelihood despite the moderate CVSS score of 6.9.
RemediationAI
Immediate action is required: discontinue use of Simple Content Management System 1.0 and upgrade to a patched version if available from code-projects, or migrate to an alternative, actively maintained CMS solution. No vendor-released patch version is independently confirmed at time of analysis; contact code-projects directly via https://code-projects.org/ for patch availability. As an interim measure, restrict network access to /web/admin/ using a Web Application Firewall (WAF) or network ACL, implementing rules to block SQL injection payloads (e.g., detecting quotes, semicolons, and common SQL keywords in the User parameter). Implement database-level access controls to limit query privileges and enable SQL query logging to detect exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exploits improper input validation in the PHP-based login functionality of a content management system. CWE-89 (SQL Injection) indicates that user-supplied input in the User parameter is directly concatenated or interpolated into SQL queries without proper parameterization or escaping. The affected product (code-projects Simple Content Management System) uses PHP to handle authentication, and the login.php endpoint at /web/admin/ is exposed to remote attackers without authentication barriers. The lack of prepared statements or input sanitization allows attackers to inject arbitrary SQL syntax, potentially bypassing authentication or extracting database contents.
Know when Simple Content Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in code-projects Simple Content Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /web/admin/login.php. Such manipulation of the argument User leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in code-projects Simple Content Management System 1.0 allows unauthenticated remote attackers to manipulat
Stored cross-site scripting (XSS) in code-projects Simple Content Management System 1.0 allows authenticated high-privil
Exploit-DB