CVE-2026-6148

CVE-2026-6148 is a SQL injection vulnerability in code-projects Vehicle Showroom Management System version 1.0, specifically within the /util/MonthTotalReportUpdateFunction.php file. An attacker can manipulate the BRANCH_ID parameter to inject arbitrary SQL commands, potentially compromising the integrity and confidentiality of the underlying database. The vulnerability carries a CVSS 3.1 severity rating of 7.3 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack complexity is low, meaning exploitation is straightforward once the vulnerable parameter is identified. A successful attack could result in unauthorized data access, data modification, and potential service disruption. Public exploit code is available for this vulnerability, elevating the risk of widespread exploitation. However, the vulnerability is not currently included on the CISA Known Exploited Vulnerabilities list and remains inactive on threat intelligence hot lists, suggesting limited active exploitation in the wild at this time. Organizations running affected versions should prioritize patching, particularly given the public availability of exploit code and the remote exploitability of this flaw.