CVE-2026-2221 is a high severity SQL injection flaw (CVSS 7.3) in the login component of code-projects Online Reviewer System 1.0. The Username argument is the problem, and it can be reached remotely. The record lists no fixed version, so limit access to the application and ask the maintainer for a patch.
What's affected
Online Reviewer System 1.0 from code-projects. The affected file is /login/index.php in the Login component, and the argument is Username.
The record lists no fixed version and no vendor advisory. Its references are a public GitHub issue and VulDB entries.
How to check if you're exposed
This is a downloadable PHP project, so you are exposed only if you installed and run it. Look for the vulnerable file in your web root and confirm the version in the project files.
find /path/to/web/root -path "*login*" -name index.php
If the site is reachable from the internet, assume it is exposed. The CVSS vector shows network access, low complexity, no privileges required and no user interaction.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allowlist, until you have a fix.
- Contact the project through its website and ask for a patched release or guidance. The record lists none.
- If you maintain a copy, change the vulnerable query to use prepared statements with bound parameters instead of building SQL from request input.
- Back up the database, then review web server and database logs for unusual requests to the affected page.
- Remove demo or coursework projects from production hosts. If you need the function, rebuild it on a maintained framework.
Why it matters
A login form is the one page every visitor can reach, so a flaw here is exposed to anyone who can load the site. That is why no privileges are required in the vector.
SQL injection happens when request input is placed into a query string and the database cannot tell the data from the command. The weaknesses mapped to this record are CWE-74 and CWE-89. Each impact score is low, which is why the base score is 7.3 and not higher.
The record says an exploit is publicly available. It does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
Quick check
Is this flaw being exploited in the wild?
The record says exploit details are public, but the CVE is not on the CISA Known Exploited Vulnerabilities list. Public details still make scanning for it more likely.
Is there a patched version?
The record does not list one. Ask the maintainer, and do not assume a newer download fixes it without checking.
Sources
Last reviewed: 19 October 2026.
