CVE Intelligence
Analysis AI-assisted

CVE-2026-2220: code-projects Online Reviewer System 1.0: SQL Injection via difficulty_id

CVE-2026-2220 is an SQL injection flaw (CWE-89) in code-projects Online Reviewer System 1.0, triggered by manipulation of the difficulty_id argument and described as remotely exploitable. NVD assigns CVSS 3.1 9.8 (critical), and the CNA VulDB lists lower scores under other CVSS versions. The record states that a public exploit exists, but the CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2220 affects code-projects Online Reviewer System 1.0. The weakness is classified as SQL injection (CWE-89) and involves an unidentified function in a PHP file of the application that handles the difficulty_id argument. The record was published on 2026-02-09 and analyzed by VulDB as CNA.

Impact

  • The NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network access, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • SQL injection can allow an attacker to read, change or delete database content if the application does not properly separate user input from queries. The actual impact depends on the database permissions and the deployment.

Affected products and versions

  • The record names code-projects Online Reviewer System version 1.0 as affected.
  • The affected product entry in the data uses the name Fabian Online Reviewer System, which differs from the vendor name in the description. This discrepancy should be verified against the vendor page at code-projects.
  • No fixed version is listed in the record.

Exploitation status

  • The CVE is not listed in CISA KEV in the sources consulted, so no confirmed active exploitation is stated.
  • The record's description says the exploit is publicly available and might be used. A tracking issue tagged as Exploit is referenced at GitHub issue 20.

Remediation and mitigation

  • No vendor fix is identified in the record. Check the code-projects site for updates or replacement versions.
  • If the application cannot be patched, restrict access to the administrative area, place it behind authentication and network controls, and remove it from internet exposure.
  • Apply defensive input validation and parameterized queries in the code. Ask the developer or integrator to confirm that the difficulty_id parameter is handled safely.
  • Review database accounts used by the application and apply least privilege.

Detection guidance

  • Review web server and application logs for unusual values in the difficulty_id parameter, such as unexpected characters or database error messages.
  • Monitor for unexpected database queries, errors or data export activity originating from the application account.
  • Track the NVD and VulDB entries for updates on the status of the issue.

Limitations of the available information

  • The record does not identify the vulnerable function name, a fixed version or a vendor advisory.
  • Scores differ by source: NVD provides CVSS 3.1 9.8, while VulDB provides 7.3 under CVSS 3.1, 5.5 under CVSS 4.0 and 7.5 under CVSS 2.0.
  • The product name in the affected data does not match the vendor name in the description.
  • The EPSS value in the record is present, but its date and relevance should be checked against the current FIRST data.

Frequently asked questions

What is CVE-2026-2220?

It is an SQL injection vulnerability (CWE-89) in code-projects Online Reviewer System 1.0, triggered through the difficulty_id argument and described as remotely exploitable.

Is CVE-2026-2220 actively exploited?

It is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit is available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.