CVE Intelligence
Analysis AI-assisted

CVE-2026-2060: Simple Blood Donor Management System 1.0 SQL Injection

A SQL injection flaw (CWE-89) has been reported in Simple Blood Donor Management System 1.0 from code-projects, in the ID argument handled by editcampaignform.php. NVD scores it 9.8 (critical) under CVSS 3.1, while the CNA VulDB lists 7.3 under CVSS 3.1. The record states a public exploit exists, but no confirmed exploitation in the wild appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A SQL injection flaw (CWE-89) was reported in Simple Blood Donor Management System 1.0 by code-projects. According to the record, the weakness involves the ID argument processed by the editcampaignform.php file and can be reached remotely.

Impact

  • A successful SQL injection can allow unintended interaction with the application database, with the actual effect depending on database permissions and application design.
  • NVD rates the issue 9.8 (critical) under CVSS 3.1, with high confidentiality, integrity and availability impact and no privileges or user interaction required.
  • The CNA VulDB scores differ: 7.3 under CVSS 3.1, 5.5 under CVSS 4.0 and 7.5 under CVSS 2.0.

Affected products and versions

  • The record lists version 1.0 of the Simple Blood Donor Management System.
  • The vendor name is inconsistent within the record: the description names code-projects, while the affected product field names Fabian Simple Blood Donor Management System.
  • No other affected versions are listed in the record.

Exploitation status

  • The record states that the exploit has been made public and could be used.
  • This CVE is not listed in the CISA KEV catalog in the record, so active exploitation is not confirmed.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • EPSS reports a probability of 0.00379 and a percentile of 0.29991.

Remediation and mitigation

  • The record contains no vendor fix. The only remediation reference is a mitigation entry pointing to a third-party issue at https://github.com/kyxh001/CVE/issues/1.
  • Treat the application as unpatched until the vendor or maintainer confirms a fixed version.
  • Restrict access to the application to trusted networks and remove it from direct internet exposure where possible.
  • Assess whether the application is still needed, and retire or replace it if no maintained version exists.
  • If the code can be modified locally, apply server-side input validation and parameterized database queries.

Detection guidance

  • Review web server and application logs for unusual requests to editcampaignform.php, particularly those with abnormal values in the ID parameter.
  • Monitor database error messages and unexpected query activity originating from the web application account.
  • Consider web application firewall rules that flag common SQL injection patterns, recognizing that such controls can be bypassed.

Limitations of the available information

  • The record does not include a vendor advisory, a patched version or a verified technical reference beyond the third-party issue.
  • The NVD and CNA scores differ, and the record does not explain the basis for the choice of scores.
  • The EPSS date in the record (2026-10-13) is later than the publication date and should be verified against the source.
  • The affected product name differs between the description and the affected product field.

Frequently asked questions

What is CVE-2026-2060?

It is a SQL injection vulnerability (CWE-89) reported in Simple Blood Donor Management System 1.0, affecting the ID argument handled by editcampaignform.php.

How severe is it?

NVD rates it 9.8 (critical) under CVSS 3.1, while the CNA VulDB lists 7.3 under CVSS 3.1, 5.5 under CVSS 4.0 and 7.5 under CVSS 2.0.

Is it being exploited in the wild?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit exists.

Is there a vendor fix?

The record does not list a vendor fix. It only includes a mitigation reference to a third-party issue, so the availability of a fixed version is unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.