Description
A vulnerability has been found in code-projects Student Web Portal 1.0. This impacts the function valreg_passwdation of the file signup.php. The manipulation of the argument reg_passwd leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-03-08
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection allowing data exfiltration or unauthorized modification
Action: Immediate Patch
AI Analysis

Impact

The Student Web Portal contains a flaw in the valreg_passwdation function of signup.php. By manipulating the reg_passwd argument an attacker can inject SQL statements into the database query. The injection can lead to unauthorized disclosure, modification, or deletion of information and can be executed from a remote host.

Affected Systems

The vulnerability affects code-projects Student Web Portal version 1.0. Only this specific release is confirmed to be susceptible.

Risk and Exploitability

The CVSS score is 6.9, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Because the exploit is remote, attackers who can reach the signup page may craft malicious input, but no confirmed public exploits are known at this time.

Generated by OpenCVE AI on April 16, 2026 at 04:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Student Web Portal to a patched release if available; if not, modify signup.php to employ prepared statements when handling reg_passwd inputs.
  • Apply strict input validation to the reg_passwd field, rejecting characters that could form SQL syntax and enforcing acceptable length limits.
  • Deploy a Web Application Firewall or database firewall rule set to detect and block typical SQL injection patterns, and monitor authentication traffic for anomalies.

Generated by OpenCVE AI on April 16, 2026 at 04:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Mar 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Carmelo
Carmelo student Web Portal
CPEs cpe:2.3:a:carmelo:student_web_portal:1.0:*:*:*:*:*:*:*
Vendors & Products Carmelo
Carmelo student Web Portal

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects student Web Portal
Vendors & Products Code-projects
Code-projects student Web Portal

Sun, 08 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Student Web Portal 1.0. This impacts the function valreg_passwdation of the file signup.php. The manipulation of the argument reg_passwd leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Student Web Portal signup.php valreg_passwdation sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Carmelo Student Web Portal
Code-projects Student Web Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-11T19:41:33.108Z

Reserved: 2026-03-07T20:14:41.541Z

Link: CVE-2026-3744

cve-icon Vulnrichment

Updated: 2026-03-11T19:41:29.026Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-08T15:15:49.190

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-3744

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T04:30:13Z

Weaknesses