rootpwn

high · CVSS v3 7.3 · CVSS v4 6.9

CVE-2026-95819

CVE-2026-95819 is a high severity SQL injection flaw in the login.php of anirbandutta9 College-Notes-Gallery. Remote attackers can inject SQ

Overview

CVE-2026-95819 is a high severity SQL injection flaw in the login.php of anirbandutta9 College-Notes-Gallery. Remote attackers can inject SQL via the user/pass parameters, potentially compromising the database. The vulnerability exists in all releases up to a specific commit and remains unpatched.

Description

A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

The flaw allows attackers to read, modify, or delete database contents, compromising confidentiality, integrity, and availability of student data. Defenders should consider the risk of data exposure and potential service disruption. The vulnerability is exploitable remotely without authentication.

Remediation

Apply the vendor's patch or upgrade to a version that includes the fix. If no patch is available, implement input validation and parameterized queries on the login.php endpoint. Additionally, restrict access to the login page via firewall rules or IP whitelisting.

Risk context

Severity is high with CVSS v3 score 7.3. No EPSS data is available, but the public disclosure and lack of vendor response increase urgency. Defenders should treat this as a critical patch priority.

Affected products

  • anirbandutta9 College-Notes-Gallery

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
—

sql-injection remote web-application authentication database high-severity unpatched

← All CVEs

Related CVEs

high

CVE-2026-94367

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

View analysis

high

CVE-2026-55105

Joplin note‑taking app is vulnerable to cross‑site scripting via Fountain rendering. Malicious Fountain code blocks can execute scripts in desktop, mobile, or server‑published notes. The issue is fixed in versions 3.6.15 and 3.7.2.

View analysis

high

CVE-2026-17618

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has a remote unauthenticated vulnerability that allows attackers to read and modify sensitive data and cause denial of service. The flaw stems from improper authorization checks in the web interface. It can be exploited without credentials, exposing critical financial transaction information.

View analysis

high

CVE-2026-17637

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to arbitrary code execution via deserialization of untrusted data. An attacker on an adjacent network can exploit this flaw to run malicious code on the FTM instance. The vulnerability could compromise transaction integrity and confidentiality.

View analysis