CVE-2026-15537
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability has been discovered in SourceCodester Online Book Store System 1.0 in the file admin/login.php. An attacker can remotely manipulate the Username argument, leading to SQL injection. The exploit has been publicly released.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage, and potential system takeover.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, validate and sanitize input data in admin/login.php.
Other vulnerabilities in SourceCodester Online Book Store System
See all- CVE-2026-15540Medium
A vulnerability was found in SourceCodester Online Book Store System 1.0, involving uncontrolled file inclusion (Local File Inclusion) in /admin/index.php. By manipulating the 'page' argument, an attacker can remotely include arbitrary PHP files, leading to unauthorized data access or code execution.
- CVE-2026-15539Medium
A vulnerability in SourceCodester Online Book Store System 1.0 allows unrestricted file upload via the book image upload feature in /admin/index.php?page=books. This can lead to remote code execution. The exploit is publicly available.
- CVE-2026-15532Low
A cross-site scripting vulnerability was found in SourceCodester Online Book Store System 1.0 in the User Management Module. Manipulation of the Name or Username arguments allows remote script execution. The exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.