CVE Intelligence
Analysis AI-assisted

CVE-2026-2221: code-projects Online Reviewer System SQL Injection in Login

CVE-2026-2221 is a SQL injection flaw in the Login component of code-projects Online Reviewer System 1.0, reached through the Username argument of /login/index.php. NVD rates it 9.8 under CVSS 3.1, and the CNA states that a public exploit has been released. The record does not list a fix, and the CVE is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2221 is a SQL injection flaw (CWE-89) in the Login component of code-projects Online Reviewer System 1.0. According to the CNA (VulDB), the flaw sits in the /login/index.php file and is triggered by manipulating the Username argument. The CNA describes the attack as remotely performable and states that an exploit has been released to the public.

Impact

  • NVD scores the issue 9.8 under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • The CNA (VulDB) provides other scores: 7.3 under CVSS 3.1, 5.5 under CVSS 4.0 and 7.5 under CVSS 2.0.
  • SQL injection can generally let an attacker read, change or disrupt data handled by the database. How far this applies here depends on the application and database configuration, which the sources do not describe.

Affected products and versions

  • The affected product is listed in the record as Fabian Online Reviewer System, version 1.0. The description names code-projects Online Reviewer System 1.0, so the vendor and product name should be confirmed against the official project page at code-projects.org.
  • The affected component is Login, at /login/index.php, through the Username argument.

Exploitation status

  • The record states that the exploit has been released to the public and may be used for attacks.
  • CISA KEV does not list this CVE, so no confirmed active exploitation or exploitation in the wild appears in the sources consulted.
  • A GitHub issue tagged as an exploit reference is cited in the VulDB entry context and in the GitHub issue. Its content is not reproduced here.

Remediation and mitigation

  • The record lists no fixed version and no vendor patch. The absence of fix data does not mean no fix exists; check the project source and the VulDB entry for updates.
  • If the product is in use, restrict access to the login page to trusted networks, and place it behind a web application firewall while assessing the risk.
  • If the code is maintained internally, use parameterized queries or prepared statements for all login inputs and validate the Username field server-side.
  • Consider isolating or replacing the application if no fix is available, and review database account privileges so the application account has only the rights it needs.

Detection guidance

  • Review web server and application logs for login requests with unusual characters, unusually long values or repeated failures in the Username field.
  • Monitor database error logs for SQL syntax errors originating from the login endpoint.
  • Watch for unexpected successful logins, new accounts or changes to user records.

Limitations of the available information

  • No fixed version, vendor advisory or patch is listed in the record.
  • The affected product name differs between the record field and the description, and the vendor identity should be verified.
  • The record includes an EPSS date of 2026-10-13, which is later than the publication date of 2026-02-09; this should be verified against the EPSS source before relying on it.
  • The sources consulted do not describe the database engine, application version history or the exact conditions required for exploitation.

Frequently asked questions

What is CVE-2026-2221?

It is a SQL injection vulnerability (CWE-89) in the Login component of code-projects Online Reviewer System 1.0, triggered through the Username argument of /login/index.php.

Is CVE-2026-2221 being actively exploited?

It is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been released.

Is there a fix for CVE-2026-2221?

The record lists no fixed version or vendor patch. Check the project source and the VulDB entry for updates, and apply access restrictions and input hardening in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.