The vulnerability CVE-2026-5666 affects the Online FIR System 1.0 by code-projects. It arises from insecure storage of sensitive data in the SQL Database Backup File Handler component, particularly in the /complaints.sql file. This flaw allows remote attackers to access sensitive information due to improper handling or protection of backup SQL files. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, no privileges required, no user interaction, and low confidentiality impact. No official fix or patch has been documented, and the exploit code is publicly available.

The vulnerability could lead to unauthorized disclosure of sensitive information stored in the SQL backup file, potentially compromising confidentiality. Since the attack can be performed remotely without authentication, it increases the risk of data exposure. However, the impact is rated medium due to the low confidentiality impact and no integrity or availability effects reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to backup files and sensitive directories, and monitor for unauthorized access attempts. Avoid exposing backup files to the internet or untrusted networks. Follow vendor channels for updates on patches or official mitigations.