CVE-2026-5035 is a SQL injection flaw (CWE-89) in code-projects Accounting System 1.0, in /view_work.php, through the en_id parameter. NVD scores it 7.3 high and says a public exploit exists. No fixed version is named, so remove public access and patch the query yourself.
What's affected
code-projects Accounting System version 1.0, per the CVE record. The weak spot is the /view_work.php file, handled by the component the record calls Parameter Handler, and the en_id argument is the input that reaches the database.
The record lists no patched release. Treat every copy of version 1.0 as affected until you have changed the code.
How to check if you're exposed
This is a downloadable PHP sample project, so there is no package manager entry to query. Look in your web root instead.
grep -rn "en_id" --include=*.php /var/www/
Open /view_work.php and read how en_id is used. If the value is placed into a SQL string by concatenation, the code is exposed. This is a sibling of CVE-2026-5034 in the same application, so review every PHP file that reads request parameters, not only this one.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every deployment of Accounting System 1.0, including test and demo copies that were put online and forgotten.
- Take public instances offline or restrict them to a VPN or an allowlist of addresses until the code is fixed.
- Rewrite the query that uses
en_idas a prepared statement with bound parameters, using PDO or mysqli, and cast numeric ids to integers before use. - Search web server and database logs for unusual values in this parameter and for SQL errors returned to clients.
- Use a dedicated low privilege database account for the app so that a query flaw cannot touch other schemas.
Why it matters
SQL injection (CWE-89, a child of the injection family CWE-74) happens when user input becomes part of a query instead of data passed to it. The write-up for this CVE states the cause plainly: the en_id value is used directly in a SQL query without cleaning or validation.
This is a second injection point in the same application as CVE-2026-5034, which suggests the codebase builds queries the same unsafe way in more than one place. The record does not flag this CVE as a CISA Known Exploited Vulnerability, but it does say the exploit has been published.
Quick check
Is there a patch for Accounting System 1.0?
None is named in the record or in the issue that reports it. Check the vendor site and the advisory for updates, and fix the query in your own copy if you must keep running it.
Is this the same bug as CVE-2026-5034?
It is the same class in the same product, but a different file and parameter. Fixing one file does not fix the other. Audit every query in the project.
Sources
Last reviewed: 19 October 2026.
