CVE-2026-3744 - Vulnerability Analysis

Overview

code-projects Student Web Portal 1.0 contains a sql injection caused by manipulation of "reg_passwd" argument in signup.php valreg_passwdation function, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data theft or modification.

Mitigation

Update to the latest version or apply patches to fix the SQL injection vulnerability.

References

• https://code-projects.org/
• https://github.com/CH0ico/CVE_choco_2
• https://github.com/CH0ico/CVE_choco_2/blob/main/report.md
• https://vuldb.com/?ctiid.349722
• https://vuldb.com/?id.349722
• https://vuldb.com/?submit.767852

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner