CVE-2026-2173 is a SQL injection flaw in code-projects Online Examination System 1.0, scored 7.3 (High) in the CVE record. The weak spot is the username and password fields on the login page. The record lists no fixed version, so take the app off public networks, and if you maintain the code, replace string built queries with prepared statements.
What's affected
- Product: code-projects Online Examination System
- Affected version: 1.0
- Location:
/login.php(Login) - Input at issue: the username and password fields on the login page
- Fixed version: none listed in the record
The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the record does not claim attacks in the wild.
Check the project page or vendor site for a newer release.
How to check if you're exposed
Start with whether the app exists in your estate at all. Sample and student projects from code listing sites often end up on a spare server and stay there.
find /var/www /srv /opt /home -path "*/login.php" 2>/dev/null
If the file turns up, confirm the app is version 1.0 and whether the web server answers from outside your network. Then open that file and read how it builds its database query. If the request value is joined into the SQL text instead of passed as a bound parameter, the weakness is present.
What to do now
- Find every copy of the app, including staging and backup hosts.
- If it faces the internet, take it offline or put it behind a VPN or an allow list of known addresses now.
- Check the project page for a patched release. If none exists, plan to retire the app or fix the query yourself.
- If you keep it, change the affected query to use prepared statements with bound parameters, and give the database account only the rights the app needs.
- Review web server and database logs for odd requests to the affected page.
Why it matters
SQL injection means user input becomes part of a database command. The record files this under CWE-89 and CWE-74. When a page glues request values into SQL text, whoever controls that value can change what the database is asked to do, which usually means reading or altering data the page was never meant to expose.
Apps from code listing sites are rarely maintained, and there is often no vendor to ship a patch. That puts the work on whoever deployed them. Treat this one as a reason to decide whether the app should be running at all.
Quick check
Is there a patch for this?
The record lists no fixed version. Check the project page or vendor site, and until you find one, limit network access to the app.
Does a dependency scan find this?
Not by itself. Dependency tools match known library versions. This weakness lives in the application source, so look at the query code directly.
Sources
The VulDB page listed in the record did not return readable content when checked, so the details here come from the CVE record itself.
Last reviewed: 19 October 2026.
