CVE-2026-15537 is a SQL injection vulnerability in SourceCodester Online Book Store System 1.0, specifically in the admin/login.php file. The vulnerability is triggered by manipulation of the Username argument, enabling remote attackers to execute arbitrary SQL commands. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9. No official fix or patch has been published by the vendor, and the affected version is 1.0 only. Public exploit code exists, but no known active exploitation in the wild has been confirmed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database via the Username parameter. This may lead to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication and requires no user interaction. However, the overall impact is rated medium due to limited scope and complexity factors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the admin/login.php endpoint. Additionally, review and sanitize all user inputs on the affected parameter to mitigate risk.