College-Notes-Gallery EUVD-2026-84949

Requires only network reachability to a deployed College-Notes-Gallery instance exposing login.php; exploitation is remote, unauthenticated, and needs no user interaction (AV:N/PR:N/UI:N), targeting the 'user' and 'pass' request parameters. The primary limiting factor is deployment scarcity - this is an obscure open-source project with a tiny install base rather than a widely fielded product - and no vendor patch exists, so mitigation depends on operator-side input sanitization or taking the login endpoint offline.

This is a classic low-priority VulDB/CNA advisory profile: a SQL injection in the login.php authentication handler of an obscure open-source GitHub project (anirbandutta9/College-Notes-Gallery). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, low-complexity exploitation, but the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L), yielding a modest 5.5 base score. The vector explicitly carries E:P (Proof-of-Concept), consistent with the description's statement that the exploit has been publicly disclosed. No EPSS score, no CISA KEV listing, and no vendor patch are present in the input. The realistic risk is low-to-moderate: exploitation is technically trivial and public exploit code exists, but the affected product is a niche hobby/student project with negligible production footprint, and the vendor did not respond, so no fix version is published (a 'rolling release' with no version identifiers). Note a tension worth flagging: a SQL injection reachable through login.php credential fields commonly enables authentication bypass and full backend data extraction, which would justify higher confidentiality/integrity impact than the vendor's uniform 'Low' ratings - the impact metrics may be understated, but this cannot be confirmed without source review. This is a high-confidence-mechanism, low-real-world-priority issue rather than a high-CVSS-but-hollow one.

A remote, unauthenticated attacker sends a crafted request to login.php with SQL metacharacters injected into the 'user' or 'pass' parameter, manipulating the backend query to bypass authentication or extract database contents. Public exploit details have been disclosed (VulDB/GitHub issue), and the CVSS vector marks exploit maturity as Proof-of-Concept (E:P), so weaponization requires little effort against an exposed instance.