Vulnerabilities ›

CVE-2026-7143

Medium

CWE-74 — Weakness Type

                    Published: Apr 27, 2026                      ·  Modified: Apr 30, 2026                      ·  Source: NVD                

CVSS v3

6.3

🔗 NVD Official

📄 Description (English)

A vulnerability was identified in 1000 Projects Portfolio Management System MCA up to 1.0. This affects an unknown function of the file /admin/block_status.php. The manipulation of the argument q leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

🤖 AI Executive Summary

CVE-2026-7143 is a SQL injection vulnerability in 1000 Projects Portfolio Management System MCA version 1.0 affecting the /admin/block_status.php file through the parameter 'q'. The vulnerability allows remote attackers to execute arbitrary SQL commands with publicly available exploits.

📄 Description (Arabic)

ثغرة حقن SQL في ملف /admin/block_status.php بنظام إدارة المشاريع 1000 Projects Portfolio Management System MCA الإصدار 1.0 وما قبله. يمكن للمهاجمين البعيدين استغلال هذه الثغرة لتنفيذ أوامر SQL تعسفية من خلال معامل 'q' غير المحقق من صحته.

🤖 ملخص تنفيذي (AI)

A SQL injection flaw exists in 1000 Projects Portfolio Management System MCA up to version 1.0 in the /admin/block_status.php file parameter 'q'. Remote attackers can exploit this publicly disclosed vulnerability to execute malicious SQL queries.

🤖 AI Intelligence Analysis Analyzed: May 17, 2026 13:32

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: medium

🏢 Affected Saudi Sectors

government banking

🎯 MITRE ATT&CK Techniques

T1190 T1083 T1005

⚖️ Saudi Risk Score (AI)

6.0

/ 10.0

🔧 Remediation Steps (English)

Immediately upgrade 1000 Projects Portfolio Management System MCA to version 1.1 or later; implement input validation and parameterized queries for all user inputs; apply Web Application Firewall (WAF) rules to block SQL injection patterns; conduct security code review of /admin/block_status.php; restrict administrative access to trusted networks only.

🔧 خطوات المعالجة (العربية)

قم بترقية نظام 1000 Projects Portfolio Management System MCA إلى الإصدار 1.1 أو أحدث فوراً؛ طبق التحقق من صحة المدخلات والاستعلامات المعاملة لجميع مدخلات المستخدم؛ طبق قواعد جدار حماية تطبيقات الويب لحجب أنماط حقن SQL؛ أجرِ مراجعة أمنية لكود الملف /admin/block_status.php؛ قيد الوصول الإداري على الشبكات الموثوقة فقط.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.2.1 5.2.2

🔵 SAMA CSF

AC-2 SI-10

🟡 ISO 27001:2022

A.12.2.1 A.14.2.1

🔗 References & Sources 5

🔗

https://1000projects.org/

cna@vuldb.com

🔗

https://github.com/9str0IL/CVE/issues/3

cna@vuldb.com

🔗

https://vuldb.com/submit/801607

cna@vuldb.com

🔗

https://vuldb.com/vuln/359742

cna@vuldb.com

🔗

https://vuldb.com/vuln/359742/cti

cna@vuldb.com

📊 CVSS Score

6.3

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityL — Low / Local

IntegrityL — Low / Local

AvailabilityL — Low / Local

📋 Quick Facts

Severity Medium

CVSS Score6.3

CWECWE-74

EPSS0.03%

Exploit No

Patch ✗ No

Published 2026-04-27

Source Feed nvd

🇸🇦 Saudi Risk Score

6.0

/ 10.0 — Saudi Risk

Priority: MEDIUM

🏷️ Tags

CWE-74

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-7143

Introduce Yourself

Sign In Required