CVE-2026-5150

code-projects Accounting System Parameter viewin_costumer.php sql injection

A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /viewin_costumer.php of the component Parameter Handler. Such manipulation of the argument cos_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Accounting System

CVE-2026-5148

YunaiV yudao-cloud page sql injection

A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This manipulation of the argument toMail causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Yunaiv

Products

Yudao-cloud

CVE-2026-5182

SourceCodester Teacher Record System Parameter sql injection

A vulnerability was found in SourceCodester Teacher Record System 1.0. Impacted is an unknown function of the file Teacher Record System of the component Parameter Handler. Performing a manipulation of the argument searchteacher results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Teacher Record System

CVE-2026-5180

SourceCodester Simple Doctors Appointment System ajax.php sql injection

A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login2. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Doctor Appointment System

CVE-2026-5179

SourceCodester Simple Doctors Appointment System login.php sql injection

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This affects an unknown part of the file /admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Doctor Appointment System

CVE-2026-5805

code-projects Easy Blog Site contact_us.php sql injection

A weakness has been identified in code-projects Easy Blog Site up to 1.0. The impacted element is an unknown function of the file /users/contact_us.php. Executing a manipulation of the argument Name can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Easy Blog Site

CVE-2026-5813

PHPGurukul Online Course Registration check_availability.php sql injection

A weakness has been identified in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /check_availability.php. Executing a manipulation of the argument cid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Online Course Registration

CVE-2026-5814

PHPGurukul Online Course Registration check_availability.php sql injection

A security vulnerability has been detected in PHPGurukul Online Course Registration 3.1. This issue affects some unknown processing of the file /admin/check_availability.php. The manipulation of the argument regno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Online Course Registration

CVE-2026-5828

code-projects Simple IT Discussion Forum addcomment.php sql injection

A vulnerability was found in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /functions/addcomment.php. The manipulation of the argument postid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple It Discussion Forum

CVE-2026-5824

code-projects Simple Laundry System userchecklogin.php sql injection

A security vulnerability has been detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /userchecklogin.php. Such manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple Laundry System

CVE-2026-5823

itsourcecode Construction Management System borrowed_tool_report.php sql injection

A weakness has been identified in itsourcecode Construction Management System 1.0. Affected by this issue is some unknown functionality of the file /borrowed_tool_report.php. This manipulation of the argument Home causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Construction Management System

CVE-2026-5829

code-projects Simple IT Discussion Forum content.php sql injection

A vulnerability was determined in code-projects Simple IT Discussion Forum 1.0. The impacted element is an unknown function of the file /pages/content.php. This manipulation of the argument post_id causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple It Discussion Forum

CVE-2026-5827

code-projects Simple IT Discussion Forum question-function.php sql injection

A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /question-function.php. The manipulation of the argument content leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple It Discussion Forum

CVE-2026-5839

PHPGurukul News Portal Project add-subcategory.php sql injection

A vulnerability was identified in PHPGurukul News Portal Project 4.1. This issue affects some unknown processing of the file /admin/add-subcategory.php. Such manipulation of the argument sucatdescription leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

News Portal Project

CVE-2026-5833

awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection

A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The name of the patch is 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Awwaiid

Products

Mcp-server-taskwarrior

CVE-2026-5837

PHPGurukul News Portal Project news-details.php sql injection

A vulnerability was found in PHPGurukul News Portal Project 4.1. This affects an unknown part of the file /news-details.php. The manipulation of the argument Comment results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

News Portal Project

CVE-2026-5838

PHPGurukul News Portal Project add-subadmins.php sql injection

A vulnerability was determined in PHPGurukul News Portal Project 4.1. This vulnerability affects unknown code of the file /admin/add-subadmins.php. This manipulation of the argument sadminusername causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

News Portal Project

CVE-2026-5840

PHPGurukul News Portal Project check_availability.php sql injection

A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

News Portal Project

CVE-2026-5848

jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection

A vulnerability was found in jeecgboot JimuReport up to 2.3.0. The affected element is the function DriverManager.getConnection of the file /drag/onlDragDataSource/testConnection of the component Data Source Handler. Performing a manipulation of the argument dbUrl results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor confirmed the issue and will provide a fix in the upcoming release.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jimureport

CVE-2026-5985

code-projects Simple IT Discussion Forum crud.php sql injection

A security flaw has been discovered in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /crud.php. The manipulation of the argument user_Id results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple It Discussion Forum