EUVD-2026-21981
GHSA-66h2-jv8h-987w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTTP request with SQL payload in ID parameter
-
DeliverySend to /web/index.php endpoint
-
ExploitBypass input validation (none present)
-
ExecutionExecute injected SQL query in database
-
ImpactExfiltrate or modify sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.9 score with network-accessible attack vector (AV:N), no authentication requirement (PR:N), and no user interaction (UI:N) indicates significant real-world risk. While the impact is limited to low severity across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), the combination of trivial exploitability (AC:L), publicly available proof-of-concept code, and the fundamental nature of SQL injection creates a meaningful attack surface. The presence of public exploit code (E:P in the CVSS vector) elevates risk from theoretical to practical, particularly for systems running unpatched or older versions. This is a legitimate priority for organizations running affected CMS instances, though not critical-severity-proper input validation and prepared statements would mitigate entirely. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to /web/index.php with a malicious SQL injection payload embedded in the ID parameter (e.g., ID=1' OR '1'='1), which is directly concatenated into the SQL query without sanitization. The database executes the attacker's injected SQL, allowing the attacker to extract sensitive data, modify records, or potentially execute operating system commands depending on database permissions and configuration. Public proof-of-concept code is available at https://github.com/Xmyronn/simple-cms-sqli-id-parameter, lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
SQL injection in code-projects Simple Content Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /web/index.php and execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Publicly available exploit code exists and the vulnerability carries a CVSS 6.9 score reflecting moderate confidentiality, integrity, and availability impact across the network-accessible endpoint.
RemediationAI
Organizations must immediately upgrade to a patched version of Simple Content Management System if available from code-projects.org, or implement immediate mitigations if no patch has been released. Primary mitigation is to apply parameterized queries (prepared statements) with bound parameters for all SQL operations, particularly those processing the ID parameter in /web/index.php. Implement input validation and whitelist acceptable ID formats (e.g., numeric-only if IDs are integers). Apply Web Application Firewall (WAF) rules to detect and block common SQL injection payloads. Restrict database user permissions to minimum required privileges. See VulDB reference at https://vuldb.com/vuln/357106 for additional technical details and patch status information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in a PHP-based content management system where user-supplied input from the ID parameter is not properly sanitized before being incorporated into SQL queries. This is a classic SQL injection flaw (CWE-89) affecting the query construction logic in /web/index.php. The CPE cpe:2.3:a:code-projects:simple_content_management_system:*:*:*:*:*:*:*:* indicates all versions and configurations of the Simple Content Management System from code-projects are potentially affected. The attack vector is network-based with low attack complexity, requiring no authentication or user interaction, making it trivially exploitable by remote attackers.
Know when Simple Content Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functionality of the file /web/index.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Missing authorization in the admin interface of code-projects Simple Content Management System 1.0 lets remote attackers
SQL injection in code-projects Simple Content Management System 1.0 allows unauthenticated remote attackers to manipulat
Stored cross-site scripting (XSS) in code-projects Simple Content Management System 1.0 allows authenticated high-privil
Exploit-DB