PT-2026-28695 · Code Projects · Nero Social Networking Site

Ahmadmarzook · Published 2026-03-27 · Updated 2026-03-28 · CVE-2026-4970

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions code-projects Social Networking Site version 1.0

Description A security flaw exists in code-projects Social Networking Site 1.0. The issue affects an unknown function within the delete photos.php file of the Endpoint component. Manipulation of the ID parameter can lead to SQL injection. The attack can be carried out remotely. The exploit has been publicly released.

Recommendations Apply a fix to address the SQL injection issue in the delete photos.php file. Restrict or disable access to the vulnerable function within the Endpoint component. Sanitize the ID parameter to prevent SQL injection attacks.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-4970

Affected Products

Nero Social Networking Site

References · 9

• 🔥 https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20in%20Social%20Networking%20Site%20v1.0%20delete_photos.php.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4970 · Security Note
• https://code-projects.org · Note
• https://vuldb.com/?submit.777870 · Note
• https://vuldb.com/?ctiid.353857 · Note
• https://twitter.com/CVEnew/status/2037719435231076617 · Twitter Post
• https://vuldb.com/?id.353857 · Note
• https://twitter.com/infoflowcloud/status/2037720298900881884 · Twitter Post
• https://twitter.com/cyberbivash/status/2037606844332421448 · Twitter Post