CVE-2026-4836: code-projects Accounting System delete.php sql injection

Published Mar 26, 2026

Updated

A vulnerability was detected in code-projects Accounting System 1.0. The affected element is an unknown function of the file /myaccount/delete.php. Performing a manipulation of the argument cosid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Affected Software

1 affected component

Code-projects Accounting System=1.0

Event History

Mar 26, 2026

CVE Published

via MITRE·01:52 AM

Data Sourced

via MITRE·01:52 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeakness

Apr 7, 58249

Event

via FIRST·05:12 PM

Frequently Asked Questions

What is the severity of CVE-2026-4836?

CVE-2026-4836 has been classified as a critical vulnerability due to its potential for SQL injection in the Accounting System.

How do I fix CVE-2026-4836?

To fix CVE-2026-4836, sanitize user inputs and implement prepared statements in the delete.php file to prevent SQL injection.

What systems are affected by CVE-2026-4836?

CVE-2026-4836 affects version 1.0 of the Code-Projects Accounting System.

What type of vulnerability is CVE-2026-4836?

CVE-2026-4836 is categorized as an SQL injection vulnerability.

How can CVE-2026-4836 be exploited?

CVE-2026-4836 can be exploited by manipulating the cos_id parameter in the delete.php file to execute arbitrary SQL queries.