CVE-2026-10170: code-projects Visitor Management System phone_0.php sql injection
A flaw has been found in code-projects Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /vms/php/phone0.php. This manipulation of the argument phone causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
code-projects Visitor Management System (/vms/php/phone_0.php)from your environment.If the /vms/php/phone_0.php endpoint is not required, remove or disable this file from the webroot to eliminate the vulnerable code path.
- Compensating control
Block or restrict access to /vms/php/phone_0.php at the network edge (WAF, reverse proxy or firewall) and/or restrict access to trusted IPs. Deploy WAF rules to detect and block SQL injection attempts against the 'phone' parameter.
- Operational
Search webserver and application logs for requests to /vms/php/phone_0.php and for signs of SQL injection exploitation; investigate and remediate any signs of compromise and restore affected data from known-good backups if necessary.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10170?
CVE-2026-10170 has a medium severity rating of 6.3.
How do I fix CVE-2026-10170?
To fix CVE-2026-10170, sanitize and validate input data in the phone parameter to prevent SQL injection.
What type of vulnerability is CVE-2026-10170?
CVE-2026-10170 is an SQL injection vulnerability affecting the Code-projects Visitor Management System.
Can CVE-2026-10170 be exploited remotely?
Yes, CVE-2026-10170 can be exploited remotely by manipulating the phone parameter.
What affected software is related to CVE-2026-10170?
CVE-2026-10170 affects version 1.0 of the Code-projects Visitor Management System.