Login Request a demo
Critical severity · published Apr 2, 2026
CVE-2026-5368
projectworlds Car Rental Project Parameter login.php sql injection
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Parameter Handler. This manipulation of the argument uname causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Car Rental Project · projectworlds
1.0 · source: vendor, NVD
Affected product
CR
Car Rental Project
projectworlds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5368
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5368
Exploit
https://github.com/eqiya17/collection-of-vulnerabilities/issues/5
Third Party Advisory
https://vuldb.com/submit/781665
Third Party Advisory
https://vuldb.com/vuln/354746
Permissions Required
https://vuldb.com/vuln/354746/cti
More from Car Rental Project
9.8
CVE-2025-4457
A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0
9.8
CVE-2025-4456
A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0
9.8
CVE-2020-24199
Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct remote code execution
7.3
CVE-2026-5634
projectworlds Car Rental Project Parameter book_car.php sql injection