CVE-2026-86168
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the /login.php file. Manipulation of the user_name argument results in SQL injection. The attack can be executed remotely, and the exploit has been released to the public.
Risk Assessment
SQL injection could allow an attacker to gain unauthorized access to the database, steal data, or take over administrator accounts.
Recommendation
Apply patches or updates to the CMS immediately, and use parameterized queries to prevent SQL injection.
Related vulnerabilities
- CVE-2026-90888Critical
The LeadSnap WordPress plugin in versions up to 1.25 contains an unauthenticated PHP Object Injection vulnerability.
- CVE-2026-39738Critical
The FunnelKit Automations WordPress plugin in versions up to 3.8.6.1 contains an unauthenticated PHP Object Injection vulnerability.
- CVE-2026-39732Critical
The Transliterator WordPress plugin in versions up to 2.5.13 contains an unauthenticated SQL Injection vulnerability.
- CVE-2026-119526Critical
The ThemeREX Royal Event WordPress theme in versions up to 2.0 contains a deserialization of untrusted data vulnerability allowing object injection.
- CVE-2026-116852Critical
The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.
- CVE-2026-116386Critical
The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.
- CVE-2026-118697Critical
In JetBrains Toolbox App before 3.9.1 and 3.8.2, and IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates. This may allow an attacker to impersonate a trusted component.
- CVE-2026-61826Critical
Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, allowing anonymous callers to perform configuration-mutating operations such as logging out the Plex integration, persisting an attacker-selected API key, binding an attacker-controlled Plex account token, and other `write_config()` operations. Missing OAuth state validation and attacker-controlled server URLs further enable server-side request forgery and credential exposure.
- CVE-2026-112816Critical
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
- CVE-2026-119706Critical
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability. Attackers can send a base64-encoded crafted pickle in serialized_named_tensors to the /update_weights endpoint, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
Original NVD description (English source)
A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The manipulation of the argument user_name results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS