CVE-2026-3745 - Vulnerability Analysis

Overview

code-projects Student Web Portal 1.0 contains a sql injection caused by manipulation of the "User" argument in profile.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version or apply patches to fix the SQL injection vulnerability.

References

• https://github.com/CH0ico/CVE_choco_4/blob/main/report.md
• https://vuldb.com/?ctiid.349723
• https://vuldb.com/?id.349723
• https://vuldb.com/?submit.767854
• https://code-projects.org/
• https://github.com/CH0ico/CVE_choco_4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner