CVE-2026-86179 Details
Description
A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the component Database Backup Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used.
A sensitive information disclosure vulnerability has been identified in Code-Projects Daily Expense Manager version 1.0. The issue arises from the 'exp_ak.sql' file, which is part of the database backup handler component. This SQL file is located within the application's web-accessible directory and can be accessed remotely without authentication. The vulnerability allows unauthorized users to retrieve the database file, which may contain sensitive information such as the application's database schema and financial records.
Remove the 'exp_ak.sql' file from the web server's document root after completing the database initialization. If the file needs to be retained, store it in a directory inaccessibly via HTTP, such as '/var/backups/daily-expense-manager/'. Additionally, configure the web server to deny access to SQL files and other database-related resources.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 6, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://code-projects.org/ | [email protected] | Not ApplicableVendor |
| https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Daily%20Expense%20Manager%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-86179 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/896102 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399311 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399311/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Code-Projects Daily Expense Manager | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 6, 2026 | New CVE Received | [email protected] |