Which versions of Project Management System are affected by CVE-2026-9584?

SQL injection in code-projects Project Management System 1.0 allows unauthenticated attackers to bypass authentication controls and access sensitive project data through the login handler.

Is there a public PoC exploit available for CVE-2026-9584?

Yes, a public proof-of-concept exploit is available for CVE-2026-9584. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9584?

Within 24 hours: Remove code-projects 1.0 from production or isolate it behind network access controls restricted to internal staff; deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the login endpoint (chk.php). Within 7 days: Enable rate limiting and account lockout policies on authentication attempts; configure audit logging for all database access attempts; scan application logs for exploitation signatures. Within 30 days: Request patch timeline from vendor; evaluate alternative project management platforms; conduct forensic analysis of database access logs for unauthorized data disclosure.

Project Management System CVE-2026-9584

Q: What is the CVSS score of CVE-2026-9584?

CVE-2026-9584 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32004 MEDIUM

SQL Injection (CWE-89)

2026-05-26 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 26, 2026 - 22:22 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 22:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 26, 2026 - 22:12 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in code-projects Project Management System 1.0. Affected is an unknown function of the file chk.php of the component Login. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Project Management System 1.0 allows remote unauthenticated attackers to manipulate database queries through the login handler (chk.php). The flaw stems from unsanitized input being passed into a SQL statement, enabling authentication-context query tampering and data disclosure. Publicly available exploit code exists, though the vulnerability is not listed in CISA KEV and no active exploitation is confirmed.

Technical ContextAI

The product is code-projects Project Management System, a PHP/MySQL web application. The defect is a classic CWE-89 SQL injection: user-controlled parameters reaching the chk.php login script are concatenated into a SQL query without parameterization or escaping, so attacker-supplied SQL metacharacters alter query logic. The affected CPE is cpe:2.3:a:code-projects:project_management_system, and the issue resides in the Login component, a pre-authentication code path. Tags (PHP, SQLi, Project Management System) corroborate the language and weakness class.

RemediationAI

No vendor-released patch identified at time of analysis; the references point only to the VulDB record (https://vuldb.com/vuln/365640) and a public exploit writeup (https://github.com/MyMySSS/CVE123/blob/main/cve3/CVE_Submission.md), with no tagged fixed release. Recommended compensating controls: parameterize the queries in chk.php using prepared statements (the definitive code-level fix); deploy a WAF rule to block SQL metacharacters on the login endpoint (trade-off: may break legitimate input containing quotes or apostrophes); restrict network access to the application via firewall or VPN so the login page is not internet-exposed (trade-off: reduces accessibility for remote users); and apply least-privilege to the database account used by the app to limit what injected queries can read or modify. Monitor https://code-projects.org/ for an updated build.