CVE-2026-0701

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /intern/admin/add_admin.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-07027.5The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in CVE-2026-07036.4The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwct CVE-2026-07049.1In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field CVE-2026-07056.7Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before b CVE-2026-07075.3A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authent CVE-2026-07086.5A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) inp CVE-2026-07097.2Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with CVE-2026-07108.4A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages durin CVE-2026-07116.8A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.CVE-2026-07146.8A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Li CVE-2026-07156.8Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An CVE-2026-07164.8A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the m