CVE-2026-6153 — Injection in Vehicle Showroom Management System

CWE-74 — Injection CWE-89 — SQL Injection5 documents5 sources

Severity

6.9MEDIUMNVD

EPSS

0.0%

top 91.54%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Code-projects Vehicle Showroom Management System

Timeline

PublishedApr 13

Description

A vulnerability was identified in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /util/StaffDetailsFunction.php. Such manipulation of the argument STAFF_ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5code-projects/vehicle_showroom_management_system1.0

🔴Vulnerability Details

GHSA

GHSA-4cv5-mvfx-4w7p: A vulnerability was identified in code-projects Vehicle Showroom Management System 1↗2026-04-13

▶

CVEList

code-projects Vehicle Showroom Management System StaffDetailsFunction.php sql injection↗2026-04-13

▶

VulDB

code-projects Vehicle Showroom Management System 1.0 StaffDetailsFunction.php STAFF_ID sql injection↗2026-04-12

▶

💬Community

Bugzilla

CVE-2026-23144 kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure↗2026-02-14

▶