{"id":"CVE-2026-4574","state":"PUBLISHED","title":"SourceCodester Simple E-learning System User Profile Update sql injection","description":"A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handler. The manipulation of the argument firstName results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.","publishedAt":"2026-03-23T05:01:42.740Z","updatedAt":"2026-03-23T13:56:16.529Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Simple E-learning System"],"affected":[{"vendor":"SourceCodester","product":"Simple E-learning System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Profile Update Handler"]}],"references":["https://vuldb.com/?id.352411","https://vuldb.com/?ctiid.352411","https://vuldb.com/?submit.775182","https://github.com/meifukun/Web-Security-PoCs/blob/main/Simple-E-learning-System/SQLi-UserProfile-firstName.md","https://www.sourcecodester.com/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4574.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4574","state":"PUBLISHED","datePublished":"2026-03-23T05:01:42.740Z","dateUpdated":"2026-03-23T13:56:16.529Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-22T08:48:17.832Z"},"containers":{"cna":{"title":"SourceCodester Simple E-learning System User Profile Update sql injection","descriptions":[{"lang":"en","value":"A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handler. The manipulation of the argument firstName results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used."}],"affected":[{"vendor":"SourceCodester","product":"Simple E-learning System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Profile Update Handler"]}],"references":[{"url":"https://vuldb.com/?id.352411","name":"VDB-352411 | SourceCodester Simple E-learning System User Profile Update sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352411","name":"VDB-352411 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.775182","name":"Submit #775182 | SourceCodester Simple E-learning System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/meifukun/Web-Security-PoCs/blob/main/Simple-E-learning-System/SQLi-UserProfile-firstName.md","tags":["exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-03-23T05:01:42.740Z"},"timeline":[{"time":"2026-03-22T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-03-22T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-03-22T09:53:25.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"563742137abc (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-23T13:56:09.247810Z","id":"CVE-2026-4574","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-23T13:56:16.529Z"}}]}}}