CVE-2026-3046
Published: 24 February 2026
Summary
CVE-2026-3046 is a medium-severity Injection (CWE-74) vulnerability in Emiloi E-Logbook With Health Monitoring System For Covid-19. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3046 is a SQL injection vulnerability in the itsourcecode E-Logbook with Health Monitoring System for COVID-19 version 1.0. The issue resides in unknown code within the file /check_profile_old.php, where manipulation of the profile_id argument triggers the injection. It is classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection), with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
The vulnerability enables remote exploitation by unauthenticated attackers with network access and low attack complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially permitting unauthorized access, modification, or disruption of database operations through the injected SQL payload.
Advisories and references, including VulDB entries (ctiid.347406, id.347406, submit.757247), a GitHub CVE submission issue, and the vendor site itsourcecode.com, document the flaw but do not specify patches or detailed mitigation steps in the available information. The exploit has been publicly disclosed, increasing the risk of widespread use.
Notable context includes the public availability of the exploit, which heightens the urgency for users of this COVID-19 health monitoring system to review and secure affected deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7458
Vulnerability details
A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The manipulation of the argument profile_id leads to sql injection. Remote exploitation of the attack…
more
is possible. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible PHP endpoint (/check_profile_old.php) of a public-facing web application directly enables initial access via exploitation of the exposed service with no authentication required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the profile_id input parameter in check_profile_old.php to block SQL injection payloads.
Mandates timely remediation of the known SQL injection flaw in the publicly disclosed E-Logbook application code.
Enables monitoring of database queries and anomalous input patterns originating from the vulnerable /check_profile_old.php endpoint.