CVE Intelligence
Analysis AI-assisted

CVE-2026-2166: code-projects Online Reviewer System 1.0 - SQL Injection in Login

A SQL injection vulnerability (CWE-89) has been reported in the login handling at /login/index.php of code-projects Online Reviewer System 1.0, where the record states that manipulation of the username and password arguments leads to SQL injection. NVD scores it 9.8 (critical) under CVSS 3.1, and the record states the attack can be carried out remotely and that a public exploit has been disclosed. The CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an SQL injection flaw (CWE-89) in the login component at /login/index.php of code-projects Online Reviewer System 1.0. Manipulating the username or password argument is stated to lead to SQL injection. NVD published the record on 2026-02-08 and marked it as Analyzed.

Impact

  • The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network reachability, low complexity, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability.
  • Inference: depending on how the application uses its database, an attacker reaching the login form could potentially affect the data the application stores.

Affected products and versions

  • The description names code-projects Online Reviewer System 1.0, while the structured affected-product field lists Fabian Online Reviewer System, version 1.0. The naming difference should be verified against the vendor and VulDB entries.
  • No fixed version is listed in the record. The absence of a listed fix does not confirm that no fix exists.

Exploitation status

  • The record states that the exploit has been publicly disclosed and may be used.
  • The CVE is not listed in CISA KEV in the record.
  • No confirmed active exploitation or exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Identify whether code-projects Online Reviewer System 1.0 is deployed and whether its login page is reachable from untrusted networks.
  • No vendor fix is identified in the record; check the VulDB entry and the product page for updates.
  • Limit exposure of the login page with network controls or access restrictions until the application is reviewed.
  • Use parameterized queries for authentication logic, validate input, and run the application database account with least privilege.

Detection guidance

  • Review web server and application logs for requests to /login/index.php with unusual or malformed content in the username and password fields.
  • Monitor database errors that occur during authentication requests.
  • Treat web application firewall alerts as a supplementary signal, not a sole control.

Limitations of the available information

  • Versions other than 1.0 are not identified in the record.
  • No fixed version or vendor patch is listed.
  • CVSS scores differ by provider: NVD gives 9.8 under CVSS 3.1, while the CNA gives 7.3 under 3.1, 5.5 under 4.0 and 7.5 under 2.0.
  • The record's title field is empty, and the EPSS entry is dated 2026-10-13 as recorded.
  • Sources were reviewed through the NVD record and the CVE.org record.

Frequently asked questions

Is CVE-2026-2166 being actively exploited?

The record says a public exploit has been disclosed, but the CVE is not listed in CISA KEV and no confirmed exploitation in the wild appears in the sources consulted.

Which versions are affected?

The record identifies version 1.0 of the Online Reviewer System. It does not list other affected versions or a fixed version.

What should administrators do now?

Confirm whether the product is deployed, limit access to the login page, review database query handling with the developer, and monitor authentication-related logs while awaiting vendor guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.