CVE Intelligence
Analysis AI-assisted

CVE-2026-2172: code-projects Online Application System for Admission SQL Injection

CVE-2026-2172 is a SQL injection flaw (CWE-89) in the enrollment/index.php file of the Login Endpoint component of code-projects Online Application System for Admission 1.0. The CNA describes remote exploitation, and NVD scores it 9.8 (critical) under CVSS 3.1. The record states a public exploit has been disclosed, but no fixed version and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2172 is classified as SQL injection (CWE-89) in the enrollment/index.php file, part of the Login Endpoint component of the code-projects Online Application System for Admission 1.0. The CNA (VulDB) reports that the flaw can be triggered remotely. The affected functionality is described only as unknown in the record, so the exact input parameter is not documented here.

Impact

NVD assigns a CVSS 3.1 base score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning network access, low complexity, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability as defined by that vector. In general terms, SQL injection in a login flow can allow an attacker to read, alter or disrupt database content. The real-world impact depends on the deployment, database permissions and what data the application stores.

Affected products and versions

  • The description names code-projects Online Application System for Admission 1.0.
  • The structured affected-product field lists 'Fabian Online Application System For Admission', version 1.0. The record therefore contains a vendor and product naming discrepancy that should be verified against the vendor page.
  • The record contains no fixed version and no patch information.

Exploitation status

The record states that the exploit has been publicly disclosed and may be utilized. CISA KEV lists this CVE as not listed, and no confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.00441 with a percentile of 0.36524, as recorded in the source data.

Remediation and mitigation

  • No vendor fix is recorded in the available sources. Check the vendor page and the VulDB entries for any update before assuming a fix exists.
  • If the application is in use, restrict access to the login and enrollment endpoints where feasible, for example through network segmentation or access controls, and limit exposure to the internet.
  • Review the application code so database queries use parameterized statements and input is validated server-side. This is a development-level fix and must be applied by whoever maintains the code.
  • Apply least privilege to the database account used by the application.
  • If the application cannot be secured or updated, consider removing it from production or replacing it.

Detection guidance

  • Review web server and application logs for unusual requests to enrollment/index.php, particularly repeated or malformed login attempts and spikes in error responses.
  • Monitor database logs for query errors or unexpected statements originating from the web application account.
  • Alert on authentication traffic volume or patterns that deviate from normal usage.

Limitations of the available information

  • No fixed version, vendor advisory or patch is included in the record.
  • The vendor and product naming differs between the description and the affected-product field.
  • The vulnerable parameter is not specified.
  • CVSS scores differ by provider: NVD 9.8 (3.1), CNA 7.3 (3.1), CNA 5.5 (4.0) and CNA 7.5 (2.0).
  • The EPSS date in the record is 2026-10-13, which should be verified against the source.
  • The record has no title, so the title in this analysis is derived from the description.

Frequently asked questions

What is CVE-2026-2172?

It is a SQL injection vulnerability (CWE-89) in enrollment/index.php, part of the Login Endpoint of code-projects Online Application System for Admission 1.0, reported as remotely exploitable.

Is there a fix for CVE-2026-2172?

The record does not list a fixed version or patch. Check the vendor and VulDB pages for updates before assuming a fix is available.

Is CVE-2026-2172 being actively exploited?

The record states a public exploit has been disclosed, but CISA KEV does not list this CVE and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.