The vulnerability CVE-2026-14700 affects code-projects Internship Management System 1.0. It is a SQL injection flaw located in an unspecified function within employer/login.php, part of the Employer Login Endpoint. The issue stems from unsafe manipulation of the email and password input parameters, enabling attackers to inject SQL commands remotely. This could allow unauthorized access or manipulation of the backend database. The vulnerability has been publicly disclosed but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this SQL injection vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database via the email or password parameters. This may lead to unauthorized data access, data modification, or other database-related impacts. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, no required privileges or user interaction, and low to limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. Until a patch is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the login endpoint. Avoid exposing the vulnerable endpoint to untrusted networks if possible.