CVE-2026-3745
published 2026-03-08CVE-2026-3745: A vulnerability was found in code-projects Student Web Portal 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument…
PriorityP354high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.30%
22.2th percentile
A vulnerability was found in code-projects Student Web Portal 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument User results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| carmelo | student_web_portal | — | — |
| code-projects | student_web_portal | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
nimiq-blockchain: Genesis batch set request
ghsa·2026-05-21
CVE-2026-46543 [MEDIUM] CWE-617 nimiq-blockchain: Genesis batch set request
nimiq-blockchain: Genesis batch set request
### Impact
A remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls `get_epoch_chunks` which iterates backwards through macro blocks using `Policy::macro_block_before`. When it reaches the genesis block number, `macro_block_before` panics with "No macro blocks before genesis block".
### Patches
[The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3745) is formally released as part of [v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0).
### Workarounds
No Workaround, although requesting the genesis batch set is not used during normal operation.
### Resources
See [PR](https://github.com/nimiq/core-rs-albatross/pull/3745).
GHSA
GHSA-xr29-4f97-vhvq: A vulnerability was found in code-projects Student Web Portal 1
ghsa_unreviewed·2026-03-08
CVE-2026-3745 [MEDIUM] CWE-74 GHSA-xr29-4f97-vhvq: A vulnerability was found in code-projects Student Web Portal 1
A vulnerability was found in code-projects Student Web Portal 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument User results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-03-08
Published