The vulnerability CVE-2026-5646 affects code-projects Easy Blog Site 1.0 in the login.php file. It allows an unauthenticated remote attacker to perform SQL injection by manipulating the username or password parameters. The CVSS 4.0 base score is 6.9 (medium severity) with attack vector network, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. No official remediation or patch is currently documented, and the vendor has not provided advisory details. The vulnerability has been publicly disclosed.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. No confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing application-level mitigations such as input validation and parameterized queries if possible. Monitor for vendor updates regarding patches or official workarounds.