CVE-2026-85643

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0

Description A remote SQL injection exists in the mysqli query() function within the admin/adduser.php file. This issue occurs when the mobile variable is manipulated, allowing an attacker to execute unauthorized database queries.

Recommendations Restrict access to the admin/adduser.php file or avoid using the mobile parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.