CVE-2026-5035
Published: 29 March 2026
Summary
CVE-2026-5035 is a medium-severity Injection (CWE-74) vulnerability in Sherlock Accounting System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-5035 is a SQL injection vulnerability in code-projects Accounting System 1.0. It affects an unknown part of the file /view_work.php within the Parameter Handler component, where manipulation of the en_id argument triggers the issue. The vulnerability, associated with CWE-74 and CWE-89, was published on 2026-03-29T07:15:56.793 and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation without authentication, privileges, or user interaction, requiring only network access and low complexity. Attackers can achieve limited impacts on confidentiality, integrity, and availability through SQL injection.
Advisories and additional details are available in referenced sources, including VulDB entries (https://vuldb.com/vuln/353961, https://vuldb.com/vuln/353961/cti, https://vuldb.com/submit/778603), a GitHub issue (https://github.com/Xu-Zhihan/CVE/issues/8), and the software site (https://code-projects.org/). The exploit has been publicly disclosed and may be used.
Notable context includes the public availability of the exploit, increasing the risk of active exploitation against unpatched instances of the affected Accounting System 1.0.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16979
Vulnerability details
A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_work.php of the component Parameter Handler. Such manipulation of the argument en_id leads to sql injection. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote SQL injection in a web application (publicly accessible endpoint /view_work.php) matches T1190 Exploit Public-Facing Application as the initial access vector; no other techniques are directly enabled by the described vulnerability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of untrusted inputs such as the en_id parameter in /view_work.php, directly preventing SQL injection exploitation.
Mandates timely identification and correction of flaws like the SQL injection vulnerability in Accounting System 1.0, eliminating the issue through patching.
Vulnerability scanning detects SQL injection issues in the Parameter Handler component, enabling prioritization and remediation specific to CVE-2026-5035.