CVE-2026-5035

code-projects Accounting System Parameter view_work.php sql injection

CVSS 6.9 MEDIUMEPSS 0.4%CWE-74 CWE-89

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 6.9EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

29 Mar 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_work.php of the component Parameter Handler. Such manipulation of the argument en_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

code-projects · Accounting System

public PoCs found — 1

cve_referencegithub.com/Xu-Zhihan/CVE/issues/8unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://code-projects.org/https://github.com/Xu-Zhihan/CVE/issues/8 https://vuldb.com/submit/778603 https://vuldb.com/vuln/353961 https://vuldb.com/vuln/353961/cti