CVE-2026-5150
Published: 30 March 2026
Summary
CVE-2026-5150 is a medium-severity Injection (CWE-74) vulnerability in Code Projects (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5150 is a SQL injection vulnerability (CWE-74, CWE-89) in code-projects Accounting System 1.0, published on 2026-03-30. It affects unknown processing of the file /viewin_costumer.php in the Parameter Handler component, where manipulation of the cos_id argument enables SQL injection.
The vulnerability is exploitable remotely by unauthenticated attackers (AV:N/AC:L/PR:N/UI:N/S:U) with low attack complexity and no user interaction required. Successful exploitation yields low impacts on confidentiality, integrity, and availability (CVSS v3.1 base score: 7.3; C:L/I:L/A:L). The exploit has been disclosed publicly and may be used.
Advisories and additional details are documented in references including https://code-projects.org/, https://github.com/Xu-Zhihan/CVE/issues/11, https://vuldb.com/submit/780199, https://vuldb.com/vuln/354183, and https://vuldb.com/vuln/354183/cti.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17217
Vulnerability details
A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /viewin_costumer.php of the component Parameter Handler. Such manipulation of the argument cos_id leads to sql injection. The attack can be…
more
launched remotely. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the public-facing web application (Accounting System) allows remote unauthenticated exploitation via manipulated parameters, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly mandates validation of information inputs like the cos_id parameter in /viewin_costumer.php to prevent SQL injection exploitation.
SI-2 requires organizations to identify, report, and remediate flaws such as the SQL injection vulnerability in the Parameter Handler component.
RA-5 employs vulnerability scanning and monitoring to detect SQL injection vulnerabilities like CVE-2026-5150 in applications such as the Accounting System.