Cyber Resilience

CVE-2026-5575

Medium

Published: 05 April 2026

Published
05 April 2026
Modified
24 April 2026
KEV Added
—
Patch
—
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0004 12.5th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5575 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-5575, published on 2026-04-05, is a SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester/jkev Record Management System 1.0. The issue affects an unknown functionality within the index.php file of the Login component, where manipulation of the Username argument enables SQL injection.

Attackers can exploit this vulnerability remotely without authentication or user interaction, as indicated by its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Exploitation allows limited impacts on confidentiality, integrity, and availability through SQL injection.

Advisories referenced in VulDB entries (vuldb.com/vuln/355345, vuldb.com/submit/783472) and a GitHub repository (github.com/whatyourname12345/CVE/blob/main/PRMS/cve_SQL.md) document the issue, with the exploit now public and available for use. No specific patches or mitigations are detailed in the available information.

The public availability of the exploit increases the risk of real-world exploitation against unpatched instances of the affected software.

EU & UK References

Vulnerability details

A vulnerability was detected in SourceCodester/jkev Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument Username results in sql injection. The attack may be…

more

launched remotely. The exploit is now public and may be used.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CVE describes a remote SQL injection vulnerability in the login component of a web-based Record Management System, directly enabling exploitation of a public-facing application without authentication.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3150Shared CWE-74, CWE-89
CVE-2026-3746Shared CWE-74, CWE-89
CVE-2025-2683Shared CWE-74, CWE-89
CVE-2026-5238Shared CWE-74, CWE-89
CVE-2026-4288Shared CWE-74, CWE-89
CVE-2026-2220Shared CWE-74, CWE-89
CVE-2025-1535Shared CWE-74, CWE-89
CVE-2026-0597Shared CWE-74, CWE-89
CVE-2026-1688Shared CWE-74, CWE-89
CVE-2026-5018Shared CWE-74, CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Prevents SQL injection attacks by enforcing input validation mechanisms on the Username parameter in the login functionality of index.php.

SI-2 Flaw Remediation good match
prevent

Remediates the specific SQL injection flaw in the SourceCodester/jkev Record Management System 1.0 login component through timely patching or code correction.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Detects the SQL injection vulnerability via vulnerability scanning of the affected web application.

References