by Kastro
Paper/Archive/CVE-2026-0583

CVE-2026-0583

code-projects Online Product Reservation System — code-projects Online Product Reservation System User Login login.php sql injection

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 38.3.383 × 207.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This vulnerability affects unknown code of the file app/user/login.php of the component User Login. The manipulation of the argument emailadd results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Affected

ProductAffectedFixed inSource
Online Product Reservation System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDB (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.339475refvuldb.com/?ctiid.339475writeupvuldb.com/?submit.731093refgithub.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_login.php.mdexploitgithub.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_login.php.md#pocrefcode-projects.org