CVE-2026-0590
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A SQL injection vulnerability was determined in code-projects Online Product Reservation System 1.0 in the file /app/checkout/delete.php. Manipulation of the ID argument allows remote exploitation, and a public exploit may be used.
Risk Assessment
An attacker could execute arbitrary SQL queries, potentially leading to deletion or modification of data and compromising system integrity.
Recommendation
Update the application to a patched version or enforce parameterized queries; until then, restrict access to the delete functionality.
Other vulnerabilities in Online Product Reservation System
See all- CVE-2026-0591Medium
A SQL injection vulnerability was identified in code-projects Online Product Reservation System 1.0 in the file /app/checkout/update.php. Manipulation of the id/qty arguments allows remote exploitation, and a public exploit may be used.
- CVE-2026-0586Medium
A cross-site scripting (XSS) vulnerability was detected in code-projects Online Product Reservation System 1.0 in the file handgunner-administrator/prod.php. Manipulation of the cat argument allows remote exploitation, and a public exploit may be used.
Original NVD description (English source)
A vulnerability was determined in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file /app/checkout/delete.php of the component POST Parameter Handler. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS