CVE-2026-7229

MediumCVSS 6.3

Published: 28/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability was found in code-projects Coaching Management System 1.0 affecting an unknown function of the file /cims/modules/admin/reply.php in the POST Handler component. Manipulating the complaintreply argument results in SQL injection, and the attack can be launched remotely. The exploit has been made public and could be used.

Risk Assessment

A remote attacker could execute arbitrary SQL queries, risking data leakage, modification, or deletion in the database.

Recommendation

Apply a fix or restrict access to the vulnerable endpoint as soon as possible; use parameterized queries and input validation.

Other vulnerabilities in Coaching Management System

CVE-2026-7222Low
XSS vulnerability in Coaching Management System 1.0 in file /cims/modules/student/complaint.php. Manipulation of the Complaint argument allows remote cross-site scripting. Exploit is publicly available.

Original NVD description (English source)

A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/reply.php of the component POST Handler. Performing a manipulation of the argument complaintreply results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS