CVE-2026-4844
Published: 26 March 2026
Summary
CVE-2026-4844 is a high-severity Injection (CWE-74) vulnerability in Code Projects (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection by requiring validation of the Username input in /admin.php to prevent malicious SQL payloads from being executed.
Requires timely identification, reporting, and correction of the SQL injection flaw in the Admin Login Module, eliminating the vulnerability through patching.
Enables vulnerability scanning to identify the SQL injection issue in /admin.php, facilitating proactive remediation before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in the unauthenticated admin login endpoint of an internet-facing web application directly enables remote exploitation of a public-facing application for initial access.
NVD Description
A vulnerability was detected in code-projects Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin.php of the component Admin Login Module. The manipulation of the argument Username results in sql injection. The attack may…
more
be performed from remote. The exploit is now public and may be used.
Deeper analysisAI
CVE-2026-4844 is a SQL injection vulnerability (CWE-74, CWE-89) in the code-projects Online Food Ordering System 1.0. The issue resides in the /admin.php file of the Admin Login Module, where manipulation of the Username argument enables SQL injection.
The vulnerability can be exploited remotely by unauthenticated attackers with low complexity, requiring no privileges or user interaction, as reflected in its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation allows limited impacts on confidentiality, integrity, and availability.
Advisories and further details are available via VulDB entries (https://vuldb.com/?ctiid.353149, https://vuldb.com/?id.353149, https://vuldb.com/?submit.776137) and the project site (https://code-projects.org/). A public exploit is available at https://gist.github.com/HxH404/8e5bd42c0f968a92a23edc5e7b879955.
The exploit's public availability heightens the risk of real-world exploitation against exposed instances of the affected software.
Details
- CWE(s)