Threats affecting pkg:github/mrpgi/cve

CVE-2026-6149 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Vehicle Showroom Management System. The flaw exists in the /util/BookVehicleFunction.php file, where manipulation of the BRANCH_ID argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. An exploit has been published, but there are no known exploits in the wild at this time. No official patch or remediation guidance is currently available from the vendor.

A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.