Cyber Posture

CVE-2026-26701

CriticalPublic PoC

Published: 02 March 2026

Published
02 March 2026
Modified
03 March 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 4.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26701 is a critical-severity SQL Injection (CWE-89) vulnerability in Jon-Remus-Sevellejo Personnel Property Equipment System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 directly prevents SQL injection in /ppes/admin/edit_tecnical_user.php by validating and sanitizing user inputs before constructing database queries.

prevent

SI-2 requires timely identification, reporting, and correction of the specific SQL injection flaw, eliminating the vulnerability through patching or code fixes.

prevent

SI-9 enforces restrictions on information inputs to the vulnerable endpoint, such as length limits and allowed character sets, blocking SQL injection payloads.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Unauthenticated remote SQL injection in a public-facing web application component directly enables T1190 (Exploit Public-Facing Application) with arbitrary SQL execution for data access/modification or potential system compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.

Deeper analysisAI

CVE-2026-26701 is a SQL injection vulnerability (CWE-89) in sourcecodester Personnel Property Equipment System version 1.0, specifically affecting the /ppes/admin/edit_tecnical_user.php component. Published on 2026-03-02T16:16:25.383, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts across confidentiality, integrity, and availability.

Remote attackers require no authentication privileges and no user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation enables attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the application's database, as well as possible system compromise depending on backend configurations.

A detailed bug report is available at https://github.com/Thirtypenny77/bug_report/blob/main/sourcecodester/personel-property-equipment-system/SQL-2.md, which documents the vulnerability but does not specify patches or mitigations in the provided CVE details.

Details

CWE(s)

Affected Products

jon-remus-sevellejo
personnel property equipment system
1.0

CVEs Like This One

CVE-2026-26700Same product: Jon-Remus-Sevellejo Personnel Property Equipment System
CVE-2026-26702Same product: Jon-Remus-Sevellejo Personnel Property Equipment System
CVE-2026-26703Same product: Jon-Remus-Sevellejo Personnel Property Equipment System
CVE-2026-26699Same product: Jon-Remus-Sevellejo Personnel Property Equipment System
CVE-2026-3180Shared CWE-89
CVE-2025-1872Shared CWE-89
CVE-2026-32458Shared CWE-89
CVE-2026-24494Shared CWE-89
CVE-2025-26875Shared CWE-89
CVE-2026-26263Shared CWE-89

References