CVE-2026-4970

CVE Database · CVE-2026-4970

CVE-2026-4970

· MEDIUMDeferred

CVSS v3.1

6.3

CVSS v4.0

2.1

EPSS

0.19%

Published

Mar 27, 2026

Modified

Apr 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file delete_photos.php of the component Endpoint. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-74CWE-89

References (5)

https://code-projects.org/

https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20in%20Social%20Networking%20Site%20v1.0%20delete_photos.php.md

https://vuldb.com/?ctiid.353857

https://vuldb.com/?id.353857

https://vuldb.com/?submit.777870

KEV Catalog EPSS Scores Vendors All CVEs