CVE-2026-7731
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A SQL injection vulnerability was detected in BloodBank Managing System 1.0 in get_state.php via manipulation of the G_STATE_ID argument. The attack can be performed remotely, and the exploit has been publicly disclosed. The affected function is not explicitly identified.
Risk Assessment
An attacker could execute arbitrary SQL queries, leading to data leakage, modification, or deletion. The public availability of the exploit increases the risk.
Recommendation
Implement parameterized SQL queries in get_state.php and restrict access to the application; consider a WAF or disabling the vulnerable endpoint until a fix is available.
Other vulnerabilities in BloodBank Managing System
Original NVD description (English source)
A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. The affected element is an unknown function of the file get_state.php. The manipulation of the argument G_STATE_ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS