The vulnerability CVE-2026-5197 affects code-projects Student Membership System 1.0. It is caused by improper sanitization of the ID parameter in the /delete_user.php script, leading to SQL injection. This allows an attacker with network access to remotely inject SQL commands, potentially manipulating or accessing the backend database. The CVSS 4.0 vector indicates the attack requires no user interaction and low privileges, with low confidentiality, integrity, and availability impact. No vendor patch or official fix has been published yet.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated low to medium due to limited privileges required and low impact on confidentiality, integrity, and availability as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation. Monitoring for suspicious activity related to the /delete_user.php endpoint is advisable. Avoid exposing this functionality to untrusted networks if possible.