CVE-2026-82701: SQL Injection in code-projects Online Shopping System

The vulnerability CVE-2026-82701 affects code-projects Online Shopping System 1.0. It is caused by improper sanitization of the 'keyword' parameter in the /action.php file's Search Functionality component, enabling an attacker to inject SQL commands remotely. This can lead to unauthorized database queries or data exposure. The CVSS 3.1 base score is 6.9 (medium severity), with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. Public exploit code has been disclosed, but no known active exploitation in the wild has been reported. There is no vendor advisory or patch available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection via the 'keyword' parameter. Monitor vendor channels for updates and patches.