Vulnerability · Published Jan 26, 2026 · Assigned by VulDB
CVE-2026-1422code-projects Online Examination System Login Page index.php sql injection
High 7.3
In plain English
A high-severity SQL injection in Online Examination System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Page. Performing a manipulation of the argument User results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| code-projects | Online Examination System | 1.0 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-342838 | code-projects Online Examination System Login Page index.php sql injection vdb-entry, technical-description
- VDB-342838 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #736606 | code-projects Online Examination System 1 SQL Injection third-party-advisory
- https://github.com/geo-chen/code-projects/blob/main/Online%20Examination%20System%20In%20PHP%20With%20Source%20Code.md#finding-2-sql-injection-on-login-page exploit
- https://code-projects.org/ product