CVE-2026-3134
Published: 25 February 2026
Summary
CVE-2026-3134 is a medium-severity Injection (CWE-74) vulnerability in Clive 21 News Portal Project. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3134 is a SQL injection vulnerability (CWE-74, CWE-89) in the itsourcecode News Portal Project 1.0. The flaw affects an unknown function in the file /newsportal/admin/edit-category.php, where manipulation of the "Category" argument enables the injection. Published on 2026-02-25, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers require no privileges, user interaction, or special access to exploit the vulnerability over the network with low complexity. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via SQL queries. A public exploit has been released and may be used in attacks.
Advisories and details are documented in references including a GitHub issue at https://github.com/910biter/cve/issues/1, the project site at https://itsourcecode.com/, and VulDB entries at https://vuldb.com/?ctiid.347629, https://vuldb.com/?id.347629, and https://vuldb.com/?submit.758324.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8574
Vulnerability details
A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-category.php. The manipulation of the argument Category results in sql injection. The attack may be performed from remote.…
more
The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in publicly exposed web app (/edit-category.php) enables unauthenticated remote exploitation for data access/modification, directly mapping to initial access via public-facing application flaws.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the Category input parameter to block SQL injection payloads before they reach the database.
Limits the database account privileges used by edit-category.php so that even a successful injection yields only minimal confidentiality/integrity impact.
Mandates timely patching or code correction of the publicly disclosed SQL injection flaw in /newsportal/admin/edit-category.php.