Matrimonial System EUVD-2026-88403

Requires a low-privilege authenticated session (PR:L) on a code-projects Matrimonial System 1.0 instance and network access to the profile-creation feature; the attacker must reach the /create_profile endpoint and submit a crafted value in the fname parameter processed by processprofile_form. No user interaction from a victim is needed and attack complexity is low. Exploitation is limited chiefly by the need for an account and by the product's near-zero real-world deployment; no non-default configuration is required.

The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection requiring only a low-privilege authenticated account, with VulDB assigning uniformly Low technical impact (VC:L/VI:L/VA:L) for a base score of 5.3 and E:P (proof-of-concept exploit code exists, not active exploitation). A public exploit (GitHub, KaranParelkar) does exist, so exploit availability is a genuine signal - but this must not be conflated with active exploitation, as there is no CISA KEV listing and no EPSS score supplied. The dominant risk-limiting factor is prevalence, not the flaw class: code-projects Matrimonial System is a free hobby/student PHP application with negligible production footprint, so despite SQLi being an inherently serious class (CWE-89), real-world priority is LOW. Note a modeling tension: VulDB rates all three impacts as merely Low, whereas an unparameterized SQL injection typically enables full database read (C:H) - the conservative Low ratings likely reflect a single-field, single-endpoint injection rather than a demonstrated full dump; treat impact as potentially higher than the 5.3 score implies but bounded by the trivial deployment base.

A low-privileged authenticated user of a Matrimonial System instance submits a crafted value in the fname field of the /create_profile profile-creation form, injecting SQL into the processprofile_form query. Because low-complexity network exploitation is possible and public proof-of-concept code (GitHub) documents the fname parameter injection, an attacker could extract or manipulate backend database records. No user interaction beyond the attacker's own request is required.