Description
A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction.php. Such manipulation of the argument cat_id leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Published: 2026-08-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A SQL injection flaw exists in the cat_id parameter of the homeaction.php script in code‑projects Online Shopping System. By injecting unsanitized input, an attacker can manipulate database queries, potentially retrieving, modifying, or deleting sensitive data. The vulnerability is classified as CWE‑89 and CWE‑74.

Affected Systems

code‑projects Online Shopping System, version 1.0. The flaw appears in the homeaction.php component and is present in the publicly released 1.0 build.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk. No EPSS rating is available, and the flaw is not listed in the CISA KEV catalog. Because the attack can be performed remotely and exploit code is publicly available, the likelihood of exploitation remains significant. Attackers can use the vulnerability to gain unauthorized database access over the network, potentially leading to data compromise or denial of service.

Generated by OpenCVE AI on August 16, 2026 at 01:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a version where the cat_id input is properly validated or the vulnerability has been fixed; if no patch is available, restrict exposure by limiting external access to the web application.
  • Configure the web or network firewall to restrict access to homeaction.php to trusted IP ranges or internal networks only.
  • Implement server‑side input validation for all parameters, and use prepared statements for database queries involving cat_id to eliminate the injection vector.

Generated by OpenCVE AI on August 16, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 16 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction.php. Such manipulation of the argument cat_id leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Title code-projects Online Shopping System homeaction.php sql injection
First Time appeared Code-projects
Code-projects online Shopping System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Shopping System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Shopping System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-18T02:23:47.670Z

Reserved: 2026-08-15T05:21:50.363Z

Link: CVE-2026-19921

cve-icon Vulnrichment

Updated: 2026-08-18T02:23:42.397Z

cve-icon NVD

Status : Deferred

Published: 2026-08-16T00:16:50.687

Modified: 2026-08-20T12:48:31.843

Link: CVE-2026-19921

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T10:30:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')