CVE Intelligence
Analysis AI-assisted

CVE-2026-2199: code-projects Online Reviewer System 1.0 SQL Injection in user-delete.php

A SQL injection flaw (CWE-89) has been reported in code-projects Online Reviewer System 1.0, in the user-delete.php file, where the ID argument is not handled safely. NVD scores it 9.8 (CVSS 3.1, critical), and the record states that the exploit has been publicly released. The CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2199 is a SQL injection weakness (CWE-89) in code-projects Online Reviewer System 1.0. According to the record, the issue sits in an unspecified function of the user-delete.php file, where the ID argument is handled in a way that allows SQL injection. The record indicates the flaw can be reached remotely and that a public exploit has been released.

Impact

  • SQL injection can allow an attacker to read, modify or delete data handled by the affected database query, depending on how the application and database are configured.
  • NVD assigns a CVSS 3.1 base score of 9.8 (critical), reflecting high confidence, high integrity and high availability impact with no privileges or user interaction required.
  • CNA-provided scores listed in the record are lower (7.3 for CVSS 3.1, 7.5 for CVSS 2.0 and 5.5 for CVSS 4.0), so the severity rating depends on the scoring source used.

Affected products and versions

  • The record lists the affected product as Fabian Online Reviewer System, version 1.0. The description names code-projects Online Reviewer System 1.0. These names differ and should be verified against the installed application.
  • No fixed version is listed in the record. The absence of a fixed version does not confirm that no fix exists.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so no exploitation in the wild is confirmed by KEV.
  • The record states that the exploit has been released to the public and may be used for attacks. A GitHub issue tagged as an exploit reference is included among the sources.
  • No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • Check whether the Online Reviewer System is deployed in your environment, particularly version 1.0.
  • Replace dynamic SQL built from request parameters with parameterized queries or prepared statements, and validate the ID value as expected for its type.
  • Restrict access to administrative user-management pages to trusted networks and accounts, and place them behind strong authentication.
  • Because no vendor fix is listed in the record, consider removing or isolating the application until a verified corrected version or code change is available from the maintainer.
  • Apply least-privilege permissions to the database account used by the application.

Detection guidance

  • Review web server and application logs for unusual or malformed requests to user-delete.php, especially requests where the ID parameter contains unexpected characters or structure.
  • Monitor database error logs for SQL syntax errors originating from the application.
  • Audit recent user deletions and changes to administrative accounts for unexpected activity.
  • Use web application firewall rules to flag suspicious parameter content on this endpoint, while understanding that these controls do not replace code fixes.

Limitations of the available information

  • The record does not identify the vendor's own advisory or a verified fixed version.
  • The CVSS scores differ between sources, and the record includes a reference tagged Permissions Required while the NVD vector indicates no privileges required. This inconsistency is unresolved.
  • The EPSS data reports a low probability of exploitation at the time of the record, but this does not indicate that exploitation is absent.
  • The exact affected code and product naming should be confirmed against the deployed application.

Frequently asked questions

What is CVE-2026-2199?

It is a SQL injection vulnerability (CWE-89) in code-projects Online Reviewer System 1.0, located in the user-delete.php file, where the ID argument is not safely handled.

Is this CVE being actively exploited?

The CISA KEV catalog does not list it, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been released.

Is there a fixed version?

The record lists no fixed version. This does not confirm that no fix exists, so check the maintainer or vendor for updates and consider isolating the application meanwhile.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.