The vulnerability CVE-2026-5634 affects projectworlds Car Rental Project 1.0. It arises from improper handling of the fname parameter in /book_car.php, allowing an attacker to inject SQL commands remotely without requiring privileges or user interaction. The vulnerability is classified as SQL injection, which can lead to unauthorized database queries. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction needed, and low to low impact on confidentiality, integrity, and availability. No official remediation or patch has been published yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score of 6.9. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce the risk of SQL injection. Monitoring for unusual database activity may also help detect exploitation attempts.