CVE-2026-36874

Sourcecodester Basic Library System v1.0 contains a SQL Injection vulnerability in the /librarysystem/load_student.php endpoint that could allow attackers to manipulate database queries and access sensitive information. The vulnerability carries a CVSS score of 2.7 (LOW) with a network-based attack vector and low complexity, but requires high-level privileges to exploit and results only in limited confidentiality impact with no integrity or availability implications. Exploitation remains minimal with no evidence of active in-the-wild attacks, no public exploit code readily available, and minimal community attention, as reflected in its absence from the Known Exploited Vulnerabilities catalog and inactive status on threat lists. The EPSS score of 0.00026 indicates this vulnerability ranks in the lowest tier for exploitation probability across all disclosed CVEs. Organizations running this library system should prioritize updates and implement proper input validation and parameterized queries to mitigate this risk, though the low severity and high privilege requirement significantly reduce the overall threat posture.