CVE-2026-5672
Published: 06 April 2026
Summary
CVE-2026-5672 is a medium-severity Injection (CWE-74) vulnerability in Code Projects (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5672 is a SQL injection vulnerability (CWE-74, CWE-89) in code-projects Simple IT Discussion Forum version 1.0. The flaw affects an unknown functionality in the /edit-category.php file of the Parameter Handler component, where manipulation of the cat_id argument triggers the injection. Published on 2026-04-06, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity.
The vulnerability enables remote exploitation by unauthenticated attackers with low attack complexity and no user interaction required. Attackers can manipulate the cat_id parameter to inject malicious SQL, potentially achieving limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption.
Mitigation guidance and additional details appear in advisories from VulDB (https://vuldb.com/vuln/355500, https://vuldb.com/vuln/355500/cti, https://vuldb.com/submit/792389), the project site (https://code-projects.org/), and a related GitHub issue (https://github.com/Czhan1156/Czhan/issues/1). The exploit has been publicly disclosed and may be actively used.
Security practitioners should scan for exposed instances of Simple IT Discussion Forum 1.0 and apply any available patches or input validation fixes promptly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19430
Vulnerability details
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument cat_id leads to sql injection. It…
more
is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (/edit-category.php) directly enables remote exploitation of public-facing applications (T1190) by unauthenticated attackers manipulating cat_id parameter.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of untrusted inputs like the cat_id parameter in /edit-category.php to directly prevent SQL injection exploitation.
Requires identification, reporting, and correction of flaws such as the SQL injection vulnerability in the Parameter Handler component.
Vulnerability scanning identifies the SQL injection in Simple IT Discussion Forum 1.0 and supports timely remediation of exposed instances.