CVE-2026-5575 Details

A SQL injection vulnerability has been identified in SourceCodester's Personnel Record Management System version 1.0. The issue arises in the Login component, specifically within the index.php file, where user input for the Username parameter is not properly sanitized. This oversight allows for SQL injection attacks that can be executed remotely. Exploitation of this vulnerability could lead to authentication bypass, unauthorized access to user accounts, and access to the administrator dashboard, where sensitive data can be viewed and modified.

It is recommended to update the application to a version that addresses this vulnerability, once available. In the meantime, users should monitor official channels for security patches. Additionally, implement input validation and use prepared statements to prevent SQL injection. Review database permissions and disable PHP error displaying in production environments.