CVE-2026-14701

code-projects Internship Management System Password Change Endpoint change_password.php sql injection

CVSS 5.3 MEDIUMEPSS 0.2%CWE-74 CWE-89

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 5.3EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

05 Jul 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/change_password.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

code-projects · Internship Management System

public PoCs found — 1

cve_referencegithub.com/zzzxc643/CVE1/blob/main/assessment/vul8.mdunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://code-projects.org/https://github.com/zzzxc643/CVE1/blob/main/assessment/vul8.md https://vuldb.com/cve/CVE-2026-14701 https://vuldb.com/submit/846890 https://vuldb.com/vuln/376297 https://vuldb.com/vuln/376297/cti