CVE-2026-5368
Medium
Elevated severity or exploit probability.
CVSS base
7.3
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS — probability of exploitation (30 days)
0.3%
26.6th percentile
CISA KEV
Not listed
Weakness / dates
CWE-89
Published 2026-04-02 · modified 2026-07-24
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | L | Low |
| Availability | L | Low |
Timeline
- 2026-04-02 — Published (NVD)
- 2026-07-24 — Last modified (NVD)
Description
A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Parameter Handler. This manipulation of the argument uname causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.