CVE-2026-77392: SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection
A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely, but the CVSS vector indicates low privileges are required. No user interaction is required.
Which input and endpoint should defenders investigate?
The affected functionality is saveUser in /public/submit.php, where the Researcher argument can be manipulated for SQL injection. Review requests to that endpoint and database activity associated with supplied Researcher values.
Is exploitation likely to be practical?
The exploit has been made publicly available, and the vulnerability is rated as low complexity. The supplied assessment indicates potential low impact to confidentiality, integrity, and availability.