Vulnerability · Published Aug 21, 2026 · Assigned by VulDB

CVE-2026-77392SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in Dynamic Input Field Generator Using HTML, CSS, and PHP from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 73.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Dynamic Input Field Generator Using HTML, CSS, and PHP	1.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-393854 | SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection vdb-entry, technical-description
VDB-393854 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-77392 | CVE Analysis and Report third-party-advisory
Submit #881045 | SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP N/A Improper Input Validation third-party-advisory
https://gist.github.com/rionyxraiza/6b22a5e02da6b8581495761ff7393760 exploit
https://www.sourcecodester.com/ product