CVE-2026-3406
Published: 02 March 2026
Summary
CVE-2026-3406 is a medium-severity Injection (CWE-74) vulnerability in Projectworlds Online Art Gallery Shop. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-3406 is a SQL injection vulnerability (CWE-74, CWE-89) in projectworlds Online Art Gallery Shop 1.0. It affects an unknown function in the file /admin/registration.php within the Registration Handler component, where manipulation of the 'fname' argument leads to injection.
The vulnerability is remotely exploitable by unauthenticated attackers requiring low complexity and no user interaction, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Exploitation enables limited impacts on confidentiality, integrity, and availability.
Advisories and additional details are documented in the following references: https://github.com/ubfbuz3/cve/issues/55, https://vuldb.com/?ctiid.348301, https://vuldb.com/?id.348301, and https://vuldb.com/?submit.763740.
The exploit has been made public and could be used, with the CVE published on 2026-03-02T03:16:01.357.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9139
Vulnerability details
A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. It is possible…
more
to launch the attack remotely. The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web app registration handler directly enables unauthenticated exploitation of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of untrusted inputs such as the 'fname' argument in /admin/registration.php before they reach SQL queries, directly blocking the injection vector.
Boundary protection mechanisms (e.g., WAF rules) can inspect and drop remote HTTP requests containing SQL metacharacters targeting registration.php.
Continuous monitoring of application and database logs can identify anomalous SQL syntax or error patterns originating from unauthenticated registration attempts.