CVE-2026-5645mediumCWE-74CWE-89

CVE-2026-5645: medium-severity vulnerability in projectworlds Car Rental System

projectworlds Car Rental System Parameter pay.php sql injection

Published

Follow this CVE+ Monitor Car Rental System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.3%
A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the component Parameter Handler. Executing a manipulation of the argument mpesa can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
projectworlds · Car Rental System
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — projectworlds Car Rental System

In the same product, most dangerous first.

CVE-2026-5637MEDIUMprojectworlds Car Rental System Parameter message_admin.php sql injectionEPSS 0.3%