Is there a public PoC exploit available for CVE-2026-92366?

Yes, a public proof-of-concept exploit is available for CVE-2026-92366. Prioritise patching immediately.

Matrimonial System CVE-2026-92366

Q: What is the CVSS score of CVE-2026-92366?

CVE-2026-92366 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80785 MEDIUM

SQL Injection (CWE-89)

2026-09-16 VulDB

GHSA-8jx2-x54x-9q63

PHP SQLi Code Projects Matrimonial System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated remote SQLi at a search endpoint typically allows full database read (C:H); integrity/availability impact via this read-oriented search query is not demonstrated, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 16, 2026 - 15:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Sep 16, 2026 - 14:51 vuln.today

CVE Published

Sep 16, 2026 - 14:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipulation of the argument sex/mothertongue/maritialstatus/country/state/religion/agemin/agemax causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in code-projects Matrimonial System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL through the /search.php endpoint of the Regular Search component by manipulating any of the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters. The vendor-scored CVSS 4.0 base of 6.9 reflects limited per-dimension impact, but our independent assessment rates it more severely on confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), since a successful injection can expose the full contents of the backend database with no credentials, user interaction, or non-default configuration required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of code-projects Matrimonial System 1.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity attack with no user interaction - the highest-exposure profile for reachability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis, so remediation must be compensating or source-level. … Detailed patch versions, workarounds, and compensating controls in full report.