Cyber Posture

CVE-2026-5368

HighPublic PoC

Published: 02 April 2026

Published
02 April 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0004 11.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5368 is a high-severity Injection (CWE-74) vulnerability in Projectworlds Car Rental Project. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents SQL injection by validating the 'uname' parameter in /login.php against organization-defined criteria to ensure only valid inputs are processed.

prevent

Requires timely identification, reporting, and correction of the specific SQL injection flaw in the Parameter Handler component of the Car Rental Project.

prevent

Enforces restrictions on information inputs like the 'uname' argument at web application boundaries to limit injection payload types, sizes, and formats.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection in public-facing web app (/login.php) directly enables T1190 Exploit Public-Facing Application for initial access and data manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Parameter Handler. This manipulation of the argument uname causes sql injection. Remote exploitation of the attack…

more

is possible. The exploit has been publicly disclosed and may be utilized.

Deeper analysisAI

CVE-2026-5368 is a SQL injection vulnerability (CWE-74, CWE-89) in the projectworlds Car Rental Project version 1.0. The issue affects an unknown function within the /login.php file of the Parameter Handler component, where manipulation of the "uname" argument enables injection. The vulnerability was published on 2026-04-02 and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), rated as High severity.

Remote attackers can exploit this vulnerability over the network with low complexity and no required privileges or user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption via SQL injection. The exploit has been publicly disclosed and is available for utilization.

Advisories referenced in VulDB entries (vuldb.com/vuln/354746 and related pages) and a GitHub issue (github.com/eqiya17/collection-of-vulnerabilities/issues/5) document the vulnerability details and public exploit, but no specific patches or mitigation steps are outlined in the available information. Security practitioners should review these sources for updates and consider input validation or upgrading the affected application.

Details

CWE(s)

Affected Products

projectworlds
car rental project
1.0

CVEs Like This One

CVE-2026-3406Same vendor: Projectworlds
CVE-2026-3759Same vendor: Projectworlds
CVE-2026-3758Same vendor: Projectworlds
CVE-2026-2136Same vendor: Projectworlds
CVE-2026-3757Same vendor: Projectworlds
CVE-2025-2657Same vendor: Projectworlds
CVE-2025-2661Same vendor: Projectworlds
CVE-2025-2662Same vendor: Projectworlds
CVE-2025-1962Same vendor: Projectworlds
CVE-2024-57328Same vendor: Projectworlds

References