EUVD-2026-19315Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/checklogin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in code-projects Online FIR System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the email and password parameters in /Login/checklogin.php. CVSS 7.3 (High) with attack vector Network, Low complexity, and No privileges required. Publicly available exploit code exists (GitHub POC published). EPSS data not provided, but the combination of unauthenticated access, public exploit, and login bypass potential makes this a significant risk for exposed instances.
Technical ContextAI
This vulnerability affects code-projects Online FIR System version 1.0, a PHP-based application for filing First Information Reports. The flaw is a classic SQL injection (CWE-89) in the authentication handler at /Login/checklogin.php. Improper sanitization of the email and password parameters allows attackers to inject arbitrary SQL commands into the backend database query. CPE identifier cpe:2.3:a:code-projects:online_fir_system:*:*:*:*:*:*:*:* confirms the affected product. SQL injection at the login boundary is particularly dangerous because it can enable authentication bypass, allowing attackers to access the application without valid credentials, in addition to standard SQLi impacts like data exfiltration or manipulation.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor website at https://code-projects.org/ should be monitored for security updates, though community-sourced projects of this nature often lack formal security response processes. Immediate mitigation requires implementing input validation and parameterized queries (prepared statements) for the email and password parameters in /Login/checklogin.php. Organizations should review all user input handling throughout the application, as the presence of SQLi in authentication code suggests broader secure coding deficiencies. Short-term compensating controls include restricting network access to the application via IP allowlisting, deploying a web application firewall with SQLi signature detection, implementing database activity monitoring to detect injection attempts, and conducting a thorough security code review of the entire codebase. Given the severity and public exploit availability, organizations unable to patch should consider discontinuing use of this application in favor of actively maintained alternatives with established security practices.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today