CVE-2026-26701
Published: 02 March 2026
Summary
CVE-2026-26701 is a critical-severity SQL Injection (CWE-89) vulnerability in Jon-Remus-Sevellejo Personnel Property Equipment System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection in /ppes/admin/edit_tecnical_user.php by validating and sanitizing user inputs before constructing database queries.
SI-2 requires timely identification, reporting, and correction of the specific SQL injection flaw, eliminating the vulnerability through patching or code fixes.
SI-9 enforces restrictions on information inputs to the vulnerable endpoint, such as length limits and allowed character sets, blocking SQL injection payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote SQL injection in a public-facing web application component directly enables T1190 (Exploit Public-Facing Application) with arbitrary SQL execution for data access/modification or potential system compromise.
NVD Description
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.
Deeper analysisAI
CVE-2026-26701 is a SQL injection vulnerability (CWE-89) in sourcecodester Personnel Property Equipment System version 1.0, specifically affecting the /ppes/admin/edit_tecnical_user.php component. Published on 2026-03-02T16:16:25.383, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts across confidentiality, integrity, and availability.
Remote attackers require no authentication privileges and no user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation enables attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the application's database, as well as possible system compromise depending on backend configurations.
A detailed bug report is available at https://github.com/Thirtypenny77/bug_report/blob/main/sourcecodester/personel-property-equipment-system/SQL-2.md, which documents the vulnerability but does not specify patches or mitigations in the provided CVE details.
Details
- CWE(s)