DIVISION REGIONAL ATHLETIC MEET GAME RESULT MATRIX SYSTEM · CVE-2026-122048 · Other
NO FIX YET
Campcodes Division Regional Athletic Meet Game Result Matrix System up to version 2.1 has an SQL injection in /dipam/check-user.php through the abbr argument. A remote attacker can send crafted requests to read or change the application's database, and a public exploit exists.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any deployment of the Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1 that exposes /dipam/check-user.php to the network. The CNA (VulDB) scores it as needing no privileges (PR:N), so assume no login is required; this was not confirmed against the code. Teams that do not run this PHP app can skip it.
Not affected if not-installed, version-above-2.1
Who cares campcodes, php, sql-injection
No fix yet, per the sources.
A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.