CVE-2026-5195
Published: 31 March 2026
Summary
CVE-2026-5195 is a medium-severity Injection (CWE-74) vulnerability in Code Projects (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5195 is a SQL injection vulnerability (CWE-74, CWE-89) discovered in code-projects Student Membership System 1.0. The flaw resides in the processing of the User Registration Handler component, where improper input handling allows manipulation leading to SQL injection. Published on 2026-03-31T09:16:23.013, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
Remote attackers require no privileges or user interaction to exploit this vulnerability. By targeting the User Registration Handler, adversaries can execute SQL injection manipulations, potentially achieving low-level impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption within the application's database.
Advisories and additional details are available through references including the project site at https://code-projects.org/, a related GitHub issue at https://github.com/maidangdang1/CVE/issues/1, and VulDB entries at https://vuldb.com/submit/780398, https://vuldb.com/vuln/354293, and https://vuldb.com/vuln/354293/cti, which may provide guidance on patches or workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17341
Vulnerability details
A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the component User Registration Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in network-accessible public-facing web app component (User Registration Handler) directly enables remote exploitation without auth, mapping to T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection in the User Registration Handler by validating all user inputs to block malicious SQL code execution.
Addresses the specific SQL injection flaw through timely identification, reporting, and remediation such as patching the vulnerable component.
Restricts user registration inputs to predefined safe formats, preventing SQL injection manipulations in the affected handler.