CVE-2026-26701
Published: 02 March 2026
Summary
CVE-2026-26701 is a critical-severity SQL Injection (CWE-89) vulnerability in Jon-Remus-Sevellejo Personnel Property Equipment System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26701 is a SQL injection vulnerability (CWE-89) in sourcecodester Personnel Property Equipment System version 1.0, specifically affecting the /ppes/admin/edit_tecnical_user.php component. Published on 2026-03-02T16:16:25.383, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts across confidentiality, integrity, and availability.
Remote attackers require no authentication privileges and no user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation enables attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the application's database, as well as possible system compromise depending on backend configurations.
A detailed bug report is available at https://github.com/Thirtypenny77/bug_report/blob/main/sourcecodester/personel-property-equipment-system/SQL-2.md, which documents the vulnerability but does not specify patches or mitigations in the provided CVE details.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9191
Vulnerability details
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote SQL injection in a public-facing web application component directly enables T1190 (Exploit Public-Facing Application) with arbitrary SQL execution for data access/modification or potential system compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection in /ppes/admin/edit_tecnical_user.php by validating and sanitizing user inputs before constructing database queries.
SI-2 requires timely identification, reporting, and correction of the specific SQL injection flaw, eliminating the vulnerability through patching or code fixes.
SI-9 enforces restrictions on information inputs to the vulnerable endpoint, such as length limits and allowed character sets, blocking SQL injection payloads.