CVE-2026-86519 Details
Description
A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used.
A sensitive information disclosure vulnerability has been identified in Code-Projects Student CRUD Operation version 1.0. The issue arises from the exposure of a SQL database file named 'card_activation.sql', which is accessible through the web server without proper authorization. This vulnerability allows remote, unauthenticated users to retrieve the SQL file, potentially disclosing sensitive information such as database schema, application records, and user account details.
To address this vulnerability, remove the 'card_activation.sql' file and any other database dumps or backups from the web server's document root. Sensitive SQL files should be stored in private locations, such as '/var/backups/application/', that are not accessible through the web. Additionally, web server configurations can be updated to deny direct access to certain file extensions, such as '.sql', '.bak', or '.dump'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://code-projects.org/ | [email protected] | Not ApplicableVendor |
| https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Student%20CRUD%20Operation%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20%60card_activation.sql%60%20Database%20File.md | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-86519 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/908879 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399673 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399673/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Code-Projects Student Crud Operation | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | [email protected] |