CVE-2026-15537 identifies a SQL injection vulnerability in SourceCodester Online Book Store System 1.0, specifically in the admin/login.php file. The vulnerability arises from improper sanitization or validation of the Username parameter, allowing an attacker to inject malicious SQL commands remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to low impact on confidentiality, integrity, and availability. No official remediation or patch has been documented, and public exploit code is available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The medium severity reflects the potential for data compromise but with limited impact on system availability or integrity as per the CVSS vector. The presence of public exploit code increases the likelihood of attacks against vulnerable systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the Username input to mitigate SQL injection risks. Monitor for updates from SourceCodester regarding patches or official mitigations.