Cyber Resilience

CVE-2026-2158

MediumPublic PoC

Published: 08 February 2026

Published
08 February 2026
Modified
11 February 2026
KEV Added
—
Patch
—
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0037 28.8th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-2158 is a medium-severity Injection (CWE-74) vulnerability in Carmelo Student Web Portal. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).

Deeper analysis

CVE-2026-2158, published on 2026-02-08, is a SQL injection vulnerability in code-projects Student Web Portal 1.0. The issue affects an unknown function within the file /check_user.php, where manipulation of the Username argument enables SQL injection. It is remotely exploitable and classified under CWEs CWE-74 and CWE-89, with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Unauthenticated attackers with network access can exploit this vulnerability remotely without requiring user interaction or special privileges. Successful exploitation allows limited impacts, including partial disclosure of sensitive information (low confidentiality), limited modification of data or behavior (low integrity), and limited denial of service (low availability).

Advisories and additional details are available in the referenced sources, including https://vuldb.com/?ctiid.344860, https://vuldb.com/?id.344860, https://vuldb.com/?submit.748816, https://code-projects.org/, and https://github.com/Qing-420/cve/blob/main/sql.md.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated remote SQL injection in a public-facing web portal directly enables exploitation of the application for initial access and limited data/behavior manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-3745Same product: Carmelo Student Web Portal
CVE-2026-3744Same product: Carmelo Student Web Portal
CVE-2026-5018Same vendor: Carmelo
CVE-2026-3705Same vendor: Carmelo
CVE-2026-0728Same vendor: Carmelo
CVE-2026-3735Same vendor: Carmelo
CVE-2026-0698Same vendor: Carmelo
CVE-2026-0701Same vendor: Carmelo
CVE-2026-3723Same vendor: Carmelo
CVE-2026-3710Same vendor: Carmelo

Affected Assets

carmelo
student web portal
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of the Username argument in check_user.php to reject SQL injection payloads before they reach the database.

SC-7 Boundary Protection partial match
prevent

Boundary protection devices can inspect remote HTTP requests and block SQL injection patterns targeting /check_user.php.

SI-4 System Monitoring partial match
detect

Continuous monitoring of application inputs and database queries can identify SQL injection attempts against the vulnerable endpoint.

References