CVE-2026-14700
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A SQL injection vulnerability has been found in the Internship Management System 1.0 in the employer/login.php file. An attacker can remotely manipulate the email/password arguments, leading to SQL injection. The exploit has been publicly disclosed.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage, and potential account takeover. The publicly available exploit increases the likelihood of rapid exploitation.
Recommendation
Immediately update the system to the latest version or apply a security patch. In the meantime, implement input validation and use parameterized queries.
Other vulnerabilities in Internship Management System
See all- CVE-2026-93980High
A weakness has been identified in code-projects Internship Management System 1.0 in the file /admin/login.php of the Admin Login Form component. Manipulating the Password argument leads to SQL injection. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-93979High
A security flaw has been discovered in code-projects Internship Management System 1.0 in the file /employer/login.php. Manipulating the Password argument results in SQL injection. The attack is possible remotely and the exploit has been released to the public.
- CVE-2026-93978High
A vulnerability was identified in code-projects Internship Management System 1.0 in the file /login.php. Manipulating the Password argument leads to SQL injection. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-14701Medium
A SQL injection vulnerability was found in the Internship Management System 1.0 in the file employer/details/change_password.php. An attacker can remotely manipulate the Current argument, leading to SQL injection. The exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Internship Management System 1.0. The impacted element is an unknown function of the file employer/login.php of the component Employer Login Endpoint. The manipulation of the argument email/password leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS