CVE-2026-86168: SQL Injection in code-projects Content Management System

This vulnerability allows remote attackers to perform SQL injection via the user_name argument in an unknown function of the /login.php file in code-projects Content Management System version 1.0. The vulnerability enables attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Public exploit code is available, but no vendor patch or fix has been documented.

Successful exploitation can lead to unauthorized SQL query execution, potentially exposing or altering sensitive data within the CMS database. The vulnerability can be exploited remotely without authentication or user interaction, increasing the attack surface. However, the impact on confidentiality, integrity, and availability is rated as low to limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the user_name parameter in /login.php. Restricting database permissions and monitoring for unusual database activity may also help mitigate risk.