CVE-2026-30520
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SourceCodester Loan Management System v1.0 has a blind SQL injection vulnerability in ajax.php (save_loan action). The borrower_id parameter is not properly sanitized, allowing an authenticated attacker to inject malicious SQL commands.
Risk Assessment
An attacker can read, modify, or delete database records, potentially leading to data leakage or system integrity compromise.
Recommendation
Update the system to the latest version or manually add input validation and parameterized SQL queries for the borrower_id parameter.
Original NVD description (English source)
A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save_loan action). The application fails to properly sanitize user input supplied to the "borrower_id" parameter in a POST request, allowing an authenticated attacker to inject malicious SQL commands.