CVE-2026-4970

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file delete_photos.php of the component Endpoint. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-49714.3A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross CVE-2026-49722.4A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /s CVE-2026-49733.5A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of t CVE-2026-497382.1The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory sepa CVE-2026-49748.8A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of t CVE-2026-497406.3TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation o CVE-2026-497418.7Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition record CVE-2026-497427.1Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via t CVE-2026-497437.8Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation obj CVE-2026-497447.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside th CVE-2026-497457.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside th CVE-2026-497467.1Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in cert