The vulnerability CVE-2026-93979 affects code-projects Internship Management System version 1.0. It is located in an unspecified part of the /employer/login.php file. By manipulating the Password argument, an attacker can perform SQL injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity. Exploit code is publicly available, but there is no information about active exploitation in the wild. No patch or vendor advisory has been provided.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection via the Password parameter in the login functionality. This can lead to unauthorized access, data leakage, or modification depending on the backend database and application logic. The presence of public exploit code increases the likelihood of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the Password parameter. Avoid exposing the vulnerable login endpoint to untrusted networks if possible.