The vulnerability CVE-2026-5196 affects code-projects Student Membership System 1.0. It is an SQL injection issue caused by improper sanitization of the ID argument in the /delete_member.php script. An attacker can remotely manipulate this parameter to execute arbitrary SQL queries on the backend database. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks a vendor-provided patch or fix at this time.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access, modification, or deletion. The impact is limited by the low privileges required and the low complexity of the attack, but the vulnerability could compromise the integrity and confidentiality of the membership system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries on the ID parameter in /delete_member.php to mitigate SQL injection risks. Monitor for updates from the vendor regarding patches or official mitigations.