The vulnerability CVE-2026-5666 affects code-projects Online FIR System 1.0 and arises from insecure storage of sensitive data within the SQL Database Backup File Handler, particularly involving the /complaints.sql file. This flaw allows an unauthenticated remote attacker to access sensitive information due to improper handling or protection of backup SQL files. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges required, no user interaction, and low confidentiality impact. No official fix or patch has been documented, and the exploit code is publicly available.

The vulnerability allows remote attackers to access sensitive information stored insecurely in the SQL backup file handler, potentially leading to unauthorized disclosure of data. The confidentiality impact is low, and there is no impact on integrity or availability. The exploit requires no privileges or user interaction, increasing the risk of remote exploitation. However, no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to backup files such as /complaints.sql and ensure proper file permissions to limit exposure. Monitoring for unauthorized access attempts to these files is advisable. Avoid exposing backup files to the internet or untrusted networks.