by Kastro
Paper/Archive/CVE-2026-0576

CVE-2026-0576

code-projects Online Product Reservation System — code-projects Online Product Reservation System Parameter prod.php sql injection

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.8.378 × 207.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was detected in code-projects Online Product Reservation System 1.0. Affected is an unknown function of the file /handgunner-administrator/prod.php of the component Parameter Handler. Performing a manipulation of the argument cat/price/name/model/serial results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Affected

ProductAffectedFixed inSource
Online Product Reservation System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDB (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.339460refvuldb.com/?ctiid.339460writeupvuldb.com/?submit.731012refgithub.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_add_prod.php.mdexploitgithub.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_add_prod.php.md#pocrefcode-projects.org