Skip to main content

Login Registration System CVE-2026-76799

| EUVDEUVD-2026-63191 MEDIUM
Files or Directories Accessible to External Parties (CWE-552)
2026-08-20 VulDB GHSA-65j8-pc6h-hh98
Information Disclosure Path Traversal Login Registration System
5.5
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-accessible static file with no auth required; confidentiality impact is Low as only the database dump is exposed, not full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Aug 20, 2026 - 02:22 NVD
6.9 (MEDIUM) 5.5 (MEDIUM)
Analysis Generated
Aug 20, 2026 - 02:13 vuln.today
CVE Published
Aug 20, 2026 - 01:15 cve.org
MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation causes files or directories accessible. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify target running Login Registration System
Exploit
Send HTTP GET to /loginsystem/database/login_registration_system.sql
Execution
Receive and download SQL dump file
Impact
Extract credentials and schema from dump
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required beyond the target being reachable over the network - the SQL backup file is served from the default installation path /loginsystem/database/login_registration_system.sql with no authentication, no special HTTP headers, and no configuration flag needed to trigger the exposure. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9, reflecting a low-complexity, fully unauthenticated network attack with limited confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker scans internet-exposed PHP applications and identifies a host running Login Registration System 1.0 by fingerprinting the /loginsystem/ path structure. They issue a direct HTTP GET request to https://[target]/loginsystem/database/login_registration_system.sql and receive the full database dump in response. …
Remediation No vendor-released patched version has been identified at time of analysis - the fix must be applied manually by operators. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-552 – Files or Directories Accessible to External Parties

View all
CVE-2016-3715 MEDIUM POC
5.5
CVE-2017-16651 HIGH POC
7.8
CVE-2023-6266 HIGH POC
7.5
CVE-2021-22015 HIGH POC
7.8
CVE-2017-14942 CRITICAL POC
9.8
CVE-2015-5211 CRITICAL POC
9.6
CVE-2020-37082 CRITICAL POC
9.8
CVE-2024-53676 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-76799 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy