CVE-2026-3745

2.1 lowEPSS 0.3%

Low (2.1) in carmelo student web portal. EPSS 0.3% chance of exploitation in the next 30 days.

A vulnerability was found in code-projects Student Web Portal 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument User results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWEs: CWE-89, CWE-74
Published: 2026-03-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

carmelo:student_web_portal

References

https://code-projects.org/
https://github.com/CH0ico/CVE_choco_4
https://github.com/CH0ico/CVE_choco_4/blob/main/report.md
https://vuldb.com/?ctiid.349723
https://vuldb.com/?id.349723

Check your stack JSON