CVE-2026-5637: projectworlds Car Rental System Parameter message_admin.php sql injection

Published Apr 6, 2026

Updated

A security vulnerability has been detected in projectworlds Car Rental System 1.0. This vulnerability affects unknown code of the file /message_admin.php of the component Parameter Handler. Such manipulation of the argument Message leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Affected Software

1 affected component

Projectworlds Car Rental System=1.0

Event History

Apr 6, 2026

CVE Published

via MITRE·08:15 AM

Data Sourced

via MITRE·08:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Apr 7, 58249

Event

via FIRST·05:26 PM

Frequently Asked Questions

What is the severity of CVE-2026-5637?

CVE-2026-5637 is classified as a high-severity SQL injection vulnerability that affects version 1.0 of the projectworlds Car Rental System.

How do I fix CVE-2026-5637?

To fix CVE-2026-5637, it is recommended to sanitize and validate user input to prevent SQL injection in the /message_admin.php file.

What components are affected by CVE-2026-5637?

CVE-2026-5637 specifically affects the Parameter Handler component of the projectworlds Car Rental System version 1.0.

Is CVE-2026-5637 exploitable remotely?

Yes, CVE-2026-5637 can be exploited remotely, allowing attackers to manipulate SQL queries through the vulnerable parameter.

What are the potential impacts of CVE-2026-5637?

The potential impacts of CVE-2026-5637 include unauthorized access to sensitive data and potential control over the database.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.