CVE-2026-2158: SQL Injection in Student Web Portal 1.0 via /check_user.php
A SQL injection flaw (CWE-89) has been reported in Student Web Portal 1.0, where manipulation of the Username argument in /check_user.php can alter database queries. The record states the attack can be started remotely, and NVD rates it 9.8 (CVSS 3.1, critical). The CVE is not listed in CISA KEV, and the record identifies no fixed version.
Overview
A SQL injection flaw (CWE-89) was reported in Student Web Portal 1.0. According to the record, the Username argument handled by /check_user.php can be manipulated to inject SQL syntax, and the attack can be started remotely. The source material is limited, so details beyond this description are not confirmed here. See the NVD entry and the CVE record.
Impact
SQL injection can allow an attacker to read, modify or delete data in the backend database, depending on database permissions and application design. NVD assigns a score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network access, no privileges required and no user interaction. The record does not describe the concrete consequences in any real deployment.
Affected products and versions
- The record lists the affected product as Carmelo Student Web Portal, version 1.0.
- The description names code-projects Student Web Portal 1.0. The two names differ and the record does not resolve this.
- No other affected versions are listed.
Exploitation status
CISA KEV does not list this CVE, so no active exploitation is claimed here. No confirmed exploitation appears in the sources consulted. A third-party GitHub document is tagged as Exploit in the record, but that tag does not establish exploitation in the wild. EPSS reports a probability of 0.00431 and a percentile of 0.35512.
Remediation and mitigation
- No fixed version is identified in the record. The absence of a fixed version does not mean no fix exists, so check with the product maintainers and the code-projects site.
- The only fix entry is typed as mitigation and points to the third-party GitHub document.
- Until an update is confirmed, restrict network exposure of the portal, especially its login functionality.
- Use parameterized queries or prepared statements in the affected code path, and review other database calls in the same application.
- Apply least privilege to the database account used by the application.
Detection guidance
- Review web server and application logs for requests to the login-related endpoint that contain unusual characters or database error messages.
- Monitor for unexpected database errors and spikes in failed authentication attempts.
- Web application firewall rules tuned to SQL injection patterns can add a layer of defense, but they do not replace a code fix.
Limitations of the available information
- The record does not confirm which vendor or project maintains the product.
- No fixed version, patch or vendor advisory is listed.
- The affected function inside /check_user.php is described as unknown.
- VulDB provides CVSS 4.0 and 2.0 scores that differ from the NVD score; these are listed as provider data and not reconciled here.
- The EPSS date in the record is later than the publication date, so its timing should be verified.
Frequently asked questions
Is CVE-2026-2158 being actively exploited?
CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. A third-party reference is tagged as Exploit, but that tag alone does not establish exploitation in the wild.
Which version is affected?
The record lists version 1.0 of the affected product. The product name differs between the description and the affected product field, and the record does not resolve this.
Is there a fixed version?
The record does not identify a fixed version. The only fix entry is typed as mitigation and points to a third-party GitHub document. Check with the product maintainers for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.