CVE-2026-29861

PHP-MYSQL-User-Login-System version 1.0 contains a critical SQL injection vulnerability in the login.php file's username parameter, allowing unauthenticated attackers to manipulate database queries. This vulnerability affects the login authentication mechanism, potentially compromising user credentials and system integrity. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network-based attack vector requiring no authentication, user interaction, or special privileges. The attack has low complexity and impacts all three security objectives: confidentiality, integrity, and availability can be completely compromised. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the KEV (Known Exploited Vulnerabilities) catalog, and community attention remains minimal based on its low EPSS score of 0.0004. Organizations running this software should prioritize patching immediately given the critical severity rating, though the immediate threat level appears relatively low at this time.