CVE-2026-2225 is a high severity SQL injection flaw (CVSS 7.3) in the administrator login of itsourcecode News Portal Project 1.0. The email argument is handled unsafely and the page is reachable remotely. The record lists no fixed version, so restrict access and ask the maintainer for a patch.
What's affected
itsourcecode News Portal Project 1.0. The affected file is /admin/index.php in the Administrator Login component, and the argument is email. The record lists the product under the vendor name clive_21.
The record lists no fixed version and no vendor advisory. Its references are a public GitHub issue and VulDB entries.
How to check if you're exposed
This is a downloadable PHP project, so you are exposed only if you installed and run it. Look for the vulnerable file in your web root and confirm the version in the project files.
find /path/to/web/root -path "*admin*" -name index.php
If the site is reachable from the internet, assume it is exposed. The CVSS vector shows network access, low complexity, no privileges required and no user interaction.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allowlist, until you have a fix.
- Contact the project through its website and ask for a patched release or guidance. The record lists none.
- If you maintain a copy, change the vulnerable query to use prepared statements with bound parameters instead of building SQL from request input.
- Back up the database, then review web server and database logs for unusual requests to the affected page.
- Remove demo or coursework projects from production hosts. If you need the function, rebuild it on a maintained framework.
Why it matters
An injection flaw in an admin login is a worse place than most, because the form exists to guard everything behind it. The vector still says no privileges are required.
SQL injection happens when request input is placed into a query string and the database cannot tell the data from the command. The weaknesses mapped to this record are CWE-74 and CWE-89. Each impact score is low, which is why the base score is 7.3 and not higher.
The record says an exploit is publicly available. It does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
Quick check
Is this flaw being exploited in the wild?
The record says exploit details are public, but the CVE is not on the CISA Known Exploited Vulnerabilities list. Public details still make scanning for it more likely.
Is there a patched version?
The record does not list one. Ask the maintainer, and do not assume a newer download fixes it without checking.
Sources
Last reviewed: 19 October 2026.
