CVE-2026-124571 · Other
NO FIX YET
A flaw in the registration page app/register.php of SourceCodester Simple CRUD lets an attacker inject SQL through the firstname field. The exploit has been published, so an attacker can read or change database contents remotely.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running the SourceCodester Simple CRUD PHP application with its registration page reachable from the network are exposed. The sources do not name a fixed version or a vendor fix, and do not say whether the flaw needs a particular configuration. Installations where the registration page is not reachable can skip it.
Not affected if registration-disabled
Who cares php, simple-crud, sourcecodester
app/register.php in the deployed Simple CRUD project and check whether the firstname value is passed into a SQL query without parameter binding.No fix yet, per the sources.
A flaw has been found in SourceCodester Simple CRUD using PHP and FPDF 1.0. Affected by this vulnerability is an unknown functionality of the file app/register.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.