CVE-2026-7063
Published: 26 April 2026
Summary
CVE-2026-7063 is a medium-severity Injection (CWE-74) vulnerability in Code Projects (inferred from references). Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-7063 is a SQL injection vulnerability (CWE-74, CWE-89) in code-projects Employee Management System 1.0. It affects unknown code in the file /370project/process/eprocess.php of the Endpoint component, where manipulation of the pwd argument triggers the issue. The vulnerability was published on 2026-04-26 and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Unauthenticated remote attackers can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL payloads.
Advisories referenced in VulDB (vuldb.com/vuln/359638 and related entries) document the issue, while a GitHub repository provides details on the SQL injection affecting the mailuid parameter in the same system. A submission entry exists at vuldb.com/submit/798615, and the original project is hosted at code-projects.org. No patches or specific mitigation guidance are mentioned in the available details. The exploit is public and may be used.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25733
Vulnerability details
A vulnerability was detected in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file /370project/process/eprocess.php of the component Endpoint. Performing a manipulation of the argument pwd results in sql injection. The attack is possible to be…
more
carried out remotely. The exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated remote SQL injection in a public-facing web application (Employee Management System) directly enables exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and error handling of untrusted inputs like the 'pwd' argument in eprocess.php.
Requires timely identification, reporting, and patching of the specific SQL injection flaw in the Employee Management System endpoint.
Mandates vulnerability scanning of hosted applications to identify SQL injection vulnerabilities such as CVE-2026-7063.