rootpwn

high · CVSS v3 7.3 · CVSS v4 6.9

CVE-2026-92926

A SQL injection vulnerability exists in the writepartnerprefs function within the /partner_preference.php file of code-projects Matrimonial

Overview

A SQL injection vulnerability exists in the writepartnerprefs function within the /partner_preference.php file of code-projects Matrimonial System 1.0. An unauthenticated remote attacker can exploit this flaw by manipulating the education parameter. This issue matters because successful exploitation could allow unauthorized database access.

Description

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Impact

This vulnerability impacts the confidentiality, integrity, and availability of the underlying database. Administrators and users of the Matrimonial System are affected as database contents could be read or modified. The attack can be executed remotely without prior authentication.

Remediation

Apply vendor-supplied patches if available or restrict access to vulnerable PHP scripts using web application firewall rules. Refactor the source code of /partner_preference.php to implement parameterized queries and proper input sanitization for the education parameter.

Risk context

The vulnerability carries a high CVSS v3 score of 7.3 and a CVSS v4 score of 6.9, indicating significant technical risk. Public disclosure of exploit details increases the urgency for defenders to apply mitigations despite the lack of an EPSS score.

Affected products

  • code-projects Matrimonial System 1.0

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
—

SQLi Web Application Remote Attack Input Validation PHP

← All CVEs

Related CVEs

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-83946

CVE-2026-83946 is a cross-site scripting vulnerability in Microsoft Azure Portal caused by insufficient input neutralization during web page generation. It can allow an unauthorized attacker to spoof portal content over a network. It matters because Azure Portal is a privileged management interface for cloud resources.

View analysis

high

CVE-2026-85887

CVE-2026-85887 is a high-severity permission misconfiguration in Microsoft 365 Copilot. It can allow an authorized attacker to disclose information over a network. It matters because it may expose sensitive tenant or user data if Copilot resources are over-permissioned.

View analysis

high

CVE-2026-93450

The go-openapi/swag jsonutils library (v0.27.0 and earlier) has a stack‑overflow flaw when parsing deeply nested JSON. Attackers can send malformed OpenAPI specs to any service that uses this library, causing the process to crash and all current requests to fail.

View analysis