CVE-2026-2171: SQL Injection in Login of code-projects Online Student Management System 1.0

Overview

CVE-2026-2171 describes an SQL injection weakness in the Login component of code-projects Online Student Management System 1.0. According to the record, the affected function is in the file accounts.php and the username and password arguments are involved. The CVE was published on 2026-02-08 and is documented by the VulDB entry, the NVD entry and the CVE record.

Impact

The record states that the attack can be initiated remotely. NVD's CVSS 3.1 base score is 9.8 (critical), with a vector describing network access, low complexity, no privileges, no user interaction and high impact on confidentiality, integrity and availability. An injection in an authentication path can expose or alter the database behind the application, but the concrete consequences depend on the deployment and are not detailed in the sources consulted.

Affected products and versions

Product named in the description: code-projects Online Student Management System 1.0.
Product entry in the structured data: Fabian Online Student Management System, version 1.0.
No fixed version is listed in the record.

The product naming differs between the description and the structured field. Administrators should confirm which codebase they run before drawing conclusions.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the data provided, so no active exploitation is confirmed by that source. The description states that the exploit has been made public and could be used, but no confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00441 with a percentile of 0.36524.

Remediation and mitigation

No vendor fix is identified in the record. Treat the fix status as unknown and check the project or vendor for updates.
Limit access to the login interface to trusted networks and avoid exposing the application to the internet without a security review.
Ask developers to replace string-built queries in the authentication code with parameterized queries and strict input validation.
If the application was reachable by untrusted users, review and rotate the accounts and credentials it stores.
Retire or isolate unmaintained deployments of this student management system.

Detection guidance

Review web server and application logs for unusual or malformed requests to the login handler, including bursts of failed authentications and database error messages returned to clients.
Monitor database logs for unexpected query activity originating from the web application account.
Alert on successful logins that follow anomalous request sequences from a single source address.

Limitations of the available information

The record provides no fixed version, no vendor advisory and an unresolved product naming mismatch. The assigned CWE is CWE-74 (Injection), a broad category, while the description specifically refers to SQL injection. Other scores in the record differ: CVSS 4.0 5.5 from the CNA, CVSS 3.1 7.3 from the CNA and CVSS 2.0 7.5 from the CNA, and the reason for these differences is not stated. The EPSS date in the record is 2026-10-13, which should be checked against the retrieval date.

Frequently asked questions

What is CVE-2026-2171?

It is an SQL injection vulnerability in the Login component (accounts.php) of code-projects Online Student Management System 1.0, triggered through the username and password arguments.

How severe is it?

NVD assigns a CVSS 3.1 base score of 9.8 with a network attack vector and no privileges or user interaction required. Other providers in the record assign different scores.

Is there a fix or is it being exploited?

The record lists no fixed version. The CVE is not in the CISA KEV catalog, and the description says a public exploit exists, but no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.