Which versions of Feedback System are affected by CVE-2026-8098?

CVE-2026-8098 is a critical authentication bypass in code-projects Feedback System 1.0 that allows unauthenticated attackers to gain administrative access through SQL injection in the login panel.

Is there a public PoC exploit available for CVE-2026-8098?

Yes, a public proof-of-concept exploit is available for CVE-2026-8098. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-8098?

Within 24 hours: Identify all instances of code-projects Feedback System 1.0 in your environment and take them offline or place behind network access controls (IP whitelist/VPN). Document inventory with hostnames and IP addresses. Within 7 days: Contact vendor for security guidance and confirm no vendor-released patch exists; evaluate alternative feedback systems or request timeline for patch availability. Within 30 days: Plan migration to patched version or replacement product; implement Web Application Firewall (WAF) rules to block SQL injection patterns in email parameters if immediate replacement is not feasible.

Feedback System CVE-2026-8098

Q: What is the CVSS score of CVE-2026-8098?

CVE-2026-8098 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28444 MEDIUM

SQL Injection (CWE-89)

2026-05-07 VulDB

GHSA-g323-63gp-7v74

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 07, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

May 07, 2026 - 21:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 07, 2026 - 21:16 vuln.today

CVE Published

May 07, 2026 - 20:30 nvd

HIGH 7.3

DescriptionCVE.org

A security vulnerability has been detected in code-projects Feedback System 1.0. Impacted is an unknown function of the file /admin/checklogin.php. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Feedback System 1.0 admin login panel allows remote unauthenticated attackers to bypass authentication and access administrative functions via crafted email parameter. Publicly available proof-of-concept exploit code exists on GitHub. CVSS 7.3 (High) with network vector and low complexity indicates straightforward exploitation requiring no special configuration. EPSS data not provided, but public POC significantly lowers exploitation barrier for opportunistic attacks against internet-exposed instances.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based application. The /admin/checklogin.php endpoint - responsible for administrative authentication - fails to properly sanitize or parameterize the 'email' input parameter before incorporating it into SQL queries. Code-projects Feedback System 1.0 is a lightweight open-source PHP application for managing user feedback, commonly deployed on LAMP/WAMP stacks. The vulnerability resides in the authentication logic itself, meaning attackers can manipulate SQL queries to bypass credential verification, enumerate database contents, or potentially escalate to full database compromise depending on database permissions and configuration.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects.org provides no security advisories and the project appears unmaintained based on lack of official response to public vulnerability disclosure. Primary remediation is application replacement with actively maintained feedback management software. If immediate replacement is not feasible, implement these compensating controls with noted trade-offs: (1) Deploy web application firewall with SQL injection signatures targeting the /admin/checklogin.php endpoint - may require custom rules for 'email' parameter, introduces latency and potential false positives blocking legitimate logins. (2) Restrict network access to /admin/ directory using IP allowlisting at web server or firewall level - limits admin access to trusted networks only, breaks remote administration workflows. (3) Place application behind authentication proxy (e.g., Authelia, oauth2-proxy) requiring separate credential verification before reaching vulnerable code - adds architectural complexity and single point of failure. (4) Monitor database query logs for UNION, OR 1=1, comment sequences (--,#,/**/) in email field submissions - detection only, does not prevent exploitation. All workarounds are temporary measures; plan migration to supported software. Review database access logs for indicators of prior compromise: unexpected admin logins, bulk SELECT queries from web application account, new administrative users.