EUVD-2026-63191
GHSA-65j8-pc6h-hh98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target running Login Registration System
-
ExploitSend HTTP GET to /loginsystem/database/login_registration_system.sql
-
ExecutionReceive and download SQL dump file
-
ImpactExtract credentials and schema from dump
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling File access restriction
MITRE ATT&CK
2 techniques across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the target being reachable over the network - the SQL backup file is served from the default installation path /loginsystem/database/login_registration_system.sql with no authentication, no special HTTP headers, and no configuration flag needed to trigger the exposure. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated exploitation with no attack prerequisites. What limits exploitation in practice: the product must be internet-exposed rather than localhost-only, the default installation directory structure must be preserved (renaming or relocating the file closes the vector), and the web server must serve the .sql file type without blocking it. The affected software is an educational/demo project, so production deployments are rare. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9, reflecting a low-complexity, fully unauthenticated network attack with limited confidentiality impact. The impact is rated VC:L rather than VC:H, which may understate the actual consequence: the exposed SQL dump likely contains user credentials (potentially including plaintext or weakly hashed passwords) and the full schema, which can enable credential stuffing or targeted follow-on attacks. A public proof-of-concept is confirmed via the GitHub advisory reference; however, no CISA KEV listing exists, and EPSS data was not provided. Real-world risk is bounded by the extremely limited deployment footprint - code-projects Login Registration System is an educational/tutorial product, not enterprise software. Defenders can treat this as low-urgency unless they can confirm the product is exposed on a public-facing host. The CVSS vector is internally consistent with the described behavior - no conflicts to flag. |
| Exploit ScenarioDerived | An attacker scans internet-exposed PHP applications and identifies a host running Login Registration System 1.0 by fingerprinting the /loginsystem/ path structure. They issue a direct HTTP GET request to https://[target]/loginsystem/database/login_registration_system.sql and receive the full database dump in response. The dump contains user table records with credentials, which the attacker parses offline for credential reuse or targeted account compromise. A public proof-of-concept advisory documents this exact request sequence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the fix must be applied manually by operators. The primary remediation is to move the SQL backup file outside the web server document root entirely, ensuring it is not reachable via HTTP under any path. As an immediate compensating control, add an .htaccess rule (for Apache) or equivalent Nginx location block to deny direct HTTP access to the /loginsystem/database/ directory - e.g., 'deny all' within that location context. Additionally, ensure the SQL dump does not contain plaintext credentials; if it does, rotate all passwords stored in the affected database immediately, as the file may already have been accessed. Restricting the application to authenticated network segments (VPN, IP allowlist) eliminates the remote attack vector entirely and is advisable for any deployment of this educational software. No formal vendor advisory URL is available; the public security advisory is at https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Login-Registration-System-login_registration_system.sql-Sensitive-Database-Disclosure.md.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-552 (Files or Directories Accessible to External Parties) describes the class of flaw where sensitive files are placed inside the web server's document root and served without authentication. In this case, the application ships a SQL dump file (login_registration_system.sql) under the path /loginsystem/database/, which is within the publicly reachable web root. PHP-based student or demo registration systems from code-projects.org commonly use this layout, storing raw .sql files for easy database restoration during development - a pattern that is dangerous in any internet-facing deployment. The CPE cpe:2.3:a:code-projects:login_registration_system:*:*:*:*:*:*:*:* confirms the affected product is the Login Registration System by code-projects, version 1.0 specifically (per EUVD-2026-63191). The tags 'Path Traversal' and 'Information Disclosure' from the intelligence sources are consistent: no traversal is actually needed here - the file is directly routable at its canonical path - but the Information Disclosure classification is accurate.
Know when Login Registration System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Network-accessible static file with no auth required; confidentiality impact is Low as only the database dump is exposed, not full system compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation causes files or directories accessible. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB