CVE-2026-14701
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A SQL injection vulnerability was found in the Internship Management System 1.0 in the file employer/details/change_password.php. An attacker can remotely manipulate the Current argument, leading to SQL injection. The exploit is publicly available.
Risk Assessment
The risk includes unauthorized database access, data leakage, and potential system takeover. The attack can be executed remotely without authentication.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement parameterized SQL queries and input validation.
Other vulnerabilities in Internship Management System
See all- CVE-2026-93980High
A weakness has been identified in code-projects Internship Management System 1.0 in the file /admin/login.php of the Admin Login Form component. Manipulating the Password argument leads to SQL injection. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-93979High
A security flaw has been discovered in code-projects Internship Management System 1.0 in the file /employer/login.php. Manipulating the Password argument results in SQL injection. The attack is possible remotely and the exploit has been released to the public.
- CVE-2026-93978High
A vulnerability was identified in code-projects Internship Management System 1.0 in the file /login.php. Manipulating the Password argument leads to SQL injection. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-14700High
A SQL injection vulnerability has been found in the Internship Management System 1.0 in the employer/login.php file. An attacker can remotely manipulate the email/password arguments, leading to SQL injection. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/change_password.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS