CVE-2026-1422 is a high severity SQL injection (CVSS 7.3) in code-projects Online Examination System 1.0. The User argument on the index.php login page reaches a database query. No vendor fix is confirmed, so do not expose this project on the internet. Fix the query with parameters if you use it.
What's affected
The record names code-projects Online Examination System version 1.0. The affected file is /index.php, in the login page component, and the argument is User. The record names no fixed version. The code-projects site hosts free source code projects, and we found no vendor advisory.
How to check if you're exposed
Check whether you run this application. Look for the project in your web roots and in any training or demo servers. If the login page builds its query by putting the User value straight into a SQL string, it is the flaw in the record.
If you find it on a server reachable from the internet, treat it as exposed and check the database for unexpected accounts or changes.
What to do now
- Find any copy of Online Examination System 1.0 in your environment.
- Take internet facing copies offline or behind a VPN.
- If you must keep it, change the login code to use parameterized queries and validate input.
- Check the database for unknown users and review web server logs.
- Prefer a maintained application for real exams, since sample code projects rarely get fixes.
Why it matters
SQL injection happens when input is joined into a query string, so the database cannot tell data from commands. The cure is parameterized queries. The record lists CWE-74 and CWE-89, injection and SQL injection, on a login page, which is the first thing anyone reaches.
The record says the exploit has been made public and could be used. It does not flag the CVE as known exploited. Source code projects like this are often copied into classrooms and small sites and never updated, which is why a record like this is worth scanning for.
The record lists these weakness classes: CWE-74 (Injection), CWE-89 (SQL Injection).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can a static code scan find this class of bug?
Often yes. Code that builds SQL from request values is a pattern a code scan can flag, which the demo above shows.
Sources
Last reviewed: 19 October 2026.
