CVE-2026-2060 is a high severity SQL injection flaw (CVSS 7.3) in code-projects Simple Blood Donor Management System 1.0. The ID argument in /simpleblooddonor/editcampaignform.php reaches a query unsafely and a public exploit exists. No fix is listed, so retire the app or fix the query.
What's affected
code-projects Simple Blood Donor Management System 1.0 is affected, in /simpleblooddonor/editcampaignform.php through the ID argument. The record lists no patched version. Applications that store donor details deserve extra care, because the data is personal.
How to check if you're exposed
Check whether the affected file exists in your deployment:
find . -name editcampaignform.php
If it does, review how the ID or user value reaches the SQL query in that file, and check your web server logs for unusual values in that parameter.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in. It will not find flaws in code you wrote, so pair it with a review of the query in the affected file.
What to do now
- Find out whether the application is deployed anywhere you manage.
- Take it off the public internet, or put it behind a login or VPN, if it is a demo or training system.
- Change the query to use prepared statements with bound parameters, and validate the value type.
- Run the database user with the least rights the application needs, and check logs for earlier abuse.
Why it matters
SQL injection, CWE-89, happens when a request value is placed into a database query as text instead of being passed as a parameter. The database cannot tell data from instructions, so crafted input can change what the query does. CWE-74 is the parent class, improper neutralization of special elements.
The fix pattern is the same everywhere: parameterized queries, input validation and a database account with the minimum rights. The CVE is not in CISA's KEV list.
Quick check
Is a vendor patch available?
The record lists none. Fix the code yourself or retire the software.
Is exploitation confirmed in the wild?
The record says an exploit is public. It does not report attacks, and the CVE is not in KEV.
Sources
Last reviewed: 19 October 2026.
