Description
A vulnerability has been found in code-projects Smart Parking System 1.0. The affected element is an unknown function of the file /parkings/parkings.php. Such manipulation of the argument street/city/status leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Smart Parking System 1.0 contains a flaw in the /parkings/parkings.php script where the street, city, and status parameters are used unsafely in SQL queries, leading to a classic SQL injection (CWE-74 and CWE-89). This flaw allows an attacker to influence the query sent to the database. The description states that the attack can be carried out remotely, implying that network access to the web server is required.

Affected Systems

The vulnerability affects the code‑projects Smart Parking System 1.0. The specific file is /parkings/parkings.php. No other product variants or versions are mentioned.

Risk and Exploitability

The CVSS score of 6.9 reflects moderate severity. The EPSS score is reported as less than 1%, indicating a low probability of exploitation given current data. The vulnerability is not listed in the CISA KEV catalog. The description announces that the exploit is public and may be used. No mention of active campaigns is present. Based on the description, authentication is not explicitly required, but the endpoint must be reachable. The attacker must be able to send HTTP requests to the web server to trigger the injection.

Generated by OpenCVE AI on August 3, 2026 at 05:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑published patch or upgrade to a newer release of the Smart Parking System if a fix is available.
  • Restrict network access to the /parkings/parkings.php endpoint using firewall rules or IP whitelisting to limit exposure to trusted networks.
  • Modify the application code to sanitize the street, city, and status parameters, and refactor dynamic SQL queries to use prepared statements or an ORM that enforces parameterization.
  • Deploy a Web Application Firewall to detect and block SQL injection patterns targeting the endpoint.
  • Monitor web server and application logs for suspicious activity related to the /parkings/parkings.php endpoint.

Generated by OpenCVE AI on August 3, 2026 at 05:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Smart Parking System 1.0. The affected element is an unknown function of the file /parkings/parkings.php. Such manipulation of the argument street/city/status leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Smart Parking System parkings.php sql injection
First Time appeared Code-projects
Code-projects smart Parking System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:smart_parking_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects smart Parking System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Smart Parking System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-07T02:48:25.755Z

Reserved: 2026-07-04T08:56:35.237Z

Link: CVE-2026-14735

cve-icon Vulnrichment

Updated: 2026-07-07T02:48:21.151Z

cve-icon NVD

Status : Deferred

Published: 2026-07-05T10:16:29.960

Modified: 2026-07-07T04:17:43.970

Link: CVE-2026-14735

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T05:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')