A vulnerability was detected in code-projects Assessment Management 1.0. (CVE-2026-76762)

CVE-2026-76762 describes a SQL injection vulnerability in code-projects Assessment Management 1.0. The flaw is located in an unknown function within the /welcome.php file, where the userid parameter is improperly sanitized, allowing remote attackers to inject SQL commands. This can lead to unauthorized information disclosure, data modification, or denial of service. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or remediation information is currently provided.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks via the userid parameter. This may result in limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity related to SQL injection attempts targeting the userid parameter.