PT-2026-28695 · Code Projects · Nero Social Networking Site

Ahmadmarzook · Publicado 2026-03-27 · Atualizado 2026-03-28 · CVE-2026-4970

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions code-projects Social Networking Site version 1.0

Description A security flaw exists in code-projects Social Networking Site 1.0. The issue affects an unknown function within the delete photos.php file of the Endpoint component. Manipulation of the ID parameter can lead to SQL injection. The attack can be carried out remotely. The exploit has been publicly released.

Recommendations Apply a fix to address the SQL injection issue in the delete photos.php file. Restrict or disable access to the vulnerable function within the Endpoint component. Sanitize the ID parameter to prevent SQL injection attacks.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2026-4970

Produtos afetados

Nero Social Networking Site

Referências · 9

• 🔥 https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20in%20Social%20Networking%20Site%20v1.0%20delete_photos.php.md · Exploit
• https://code-projects.org · Nota
• https://vuldb.com/?submit.777870 · Nota
• https://vuldb.com/?ctiid.353857 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4970 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037719435231076617 · Publicação no Twitter
• https://vuldb.com/?id.353857 · Nota
• https://twitter.com/infoflowcloud/status/2037720298900881884 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2037606844332421448 · Publicação no Twitter