CVE Intelligence
Analysis AI-assisted

CVE-2026-2195: Code-projects Online Reviewer System 1.0 SQL Injection

A SQL injection vulnerability (CWE-89) has been reported in code-projects Online Reviewer System 1.0, where the ID argument of an admin assessment page can be manipulated remotely. NVD rates it 9.8 (critical) under CVSS 3.1, while the CNA VulDB scores differ. The record notes public disclosure of an exploit, but no confirmed exploitation in the wild appears in the sources consulted and no fixed version is listed.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A SQL injection flaw (CWE-89) has been reported in code-projects Online Reviewer System 1.0. According to the record, the vulnerable code sits in an admin assessment component and is triggered through manipulation of the ID argument. The product's public page is code-projects.org.

Impact

  • Because the flaw is classed as SQL injection, an attacker who can reach the affected page could potentially read or alter database content, depending on how the database is configured.
  • NVD assigns CVSS 3.1 base score 9.8 (critical), with high impact on confidentiality, integrity and availability, and no privileges or user interaction required. This is a scoring statement from the source, not a measured result.
  • Other CNA scores in the record are 7.3 (CVSS 3.1), 7.5 (CVSS 2.0) and 5.5 (CVSS 4.0), so severity assessments vary by provider.

Affected products and versions

  • The record lists version 1.0 of the product.
  • The affected-product field names 'Fabian Online Reviewer System', while the description names code-projects. This discrepancy should be verified against the vendor and VulDB entries.
  • No fixed version is listed in the record.

Exploitation status

  • The record states that the exploit has been disclosed to the public and may be used. A GitHub issue tagged as exploit-related is referenced.
  • The CISA KEV catalogue does not list this CVE in the record, so no confirmed active exploitation in the wild is stated by the sources consulted.
  • The EPSS probability in the record is 0.00376 with a percentile of 0.29665.

Remediation and mitigation

  • No vendor patch or fixed version is identified in the record. Organisations should confirm with the vendor or maintainers whether any update exists.
  • Where the product is in use, consider restricting access to administrative paths to trusted networks and users until the software is reviewed.
  • Review whether the application uses parameterised queries and validated input for all identifier parameters. Treat the product as untrusted if it cannot be updated.
  • Consider removing or replacing the software if it is not essential, since public exploit information is available.

Detection guidance

  • Review web server and application logs for unusual or repeated requests to the affected administrative assessment page, especially with abnormal ID parameter values.
  • Monitor database error messages and unexpected query volume originating from the application.
  • Alert on access to administrative paths from unexpected sources.

Limitations of the available information

  • The record does not identify a fixed version, patch or vendor advisory.
  • The affected product name is inconsistent between the description and the affected-product field.
  • The record's EPSS date (2026-10-13) is later than its publication date, so the EPSS values should be checked against the current source.
  • Details of the vulnerable code are described only at a high level.

Frequently asked questions

What is the vulnerability in CVE-2026-2195?

The record describes a SQL injection flaw (CWE-89) in code-projects Online Reviewer System 1.0, triggered by manipulating the ID argument on an admin assessment page.

Is there a fixed version available?

No fixed version is listed in the record. Confirm with the vendor or maintainers whether an update exists.

Is this CVE known to be actively exploited?

The record says a public exploit has been disclosed, but the CVE is not listed in CISA KEV and the sources consulted do not confirm exploitation in the wild.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.