CVE-2026-14735: SQL Injection in code-projects Smart Parking System 1.0

Technical summary

CVE-2026-14735 is a SQL injection flaw (CWE-89, CWE-74) affecting an unspecified function within /parkings/parkings.php in Smart Parking System 1.0. The vulnerability arises from insufficient input sanitization on the street, city, and status parameters, permitting direct SQL command injection. The attack vector is network-based, requires no authentication or user interaction, and impacts confidentiality, integrity, and availability of the underlying database. CVSS v3.1 score is 7.3 (HIGH).

Business impact

Organizations deploying Smart Parking System 1.0 face immediate risk of unauthorized data access, database manipulation, and potential service disruption. Attackers can exfiltrate sensitive parking or user data, corrupt records, or disrupt operational availability. Public disclosure of the vulnerability means threat actors have clear guidance on exploitation targets and methods. Remediation delay increases exposure window and likelihood of compromise.

Affected systems

code-projects Smart Parking System version 1.0 is confirmed affected. The vulnerability is triggered through the web interface at /parkings/parkings.php when processing the street, city, or status parameters. Any deployment of version 1.0 without compensating controls is at risk.

Exploitability

Exploitability is high. The vulnerability requires no credentials, user interaction, or special system configuration—only network access to the affected endpoint. The public disclosure means proof-of-concept details are available in the wild, lowering the barrier to attack. Active exploitation is credible and may already be underway given the CVSS score and public nature of the disclosure.

Remediation

Immediate action is required. Verify if your organization runs Smart Parking System 1.0 in production. Contact the vendor (code-projects) to confirm availability of patches or supported upgrade paths. If a patched version is available, prioritize deployment. If the system is non-critical or can be decommissioned, consider removal. Pending vendor remediation, implement network segmentation to restrict access to /parkings/parkings.php and apply Web Application Firewall (WAF) rules to block SQL injection patterns in the affected parameters.

Patch guidance

Check the code-projects advisory for patch availability and version recommendations for Smart Parking System. Apply any released security updates immediately upon validation in a non-production environment. If no patch is available from the vendor, escalate to request a timeline. Document the patch deployment and verify functionality post-update. Until patched, rely on network and application-layer controls.

Detection guidance

Monitor HTTP requests to /parkings/parkings.php for SQL injection signatures in the street, city, and status parameters (e.g., quotes, UNION operators, comments, boolean operators). Configure intrusion detection systems (IDS) and WAF rules to flag or block payloads matching common SQL injection patterns. Review database logs for unusual query execution, unauthorized database access, or failed authentication attempts from application accounts. Implement query rate-limiting on the affected endpoint.

Why prioritize this

This vulnerability ranks high for immediate remediation due to: (1) public disclosure enabling widespread exploitation, (2) no authentication required, (3) direct impact on confidentiality and integrity through SQL injection, (4) CVSS 7.3 (HIGH) score reflecting network exploitability and data compromise risk, and (5) a core business function (parking management) potentially affected. Speed of deployment is critical.

Risk score, explained

The CVSS v3.1 score of 7.3 reflects a HIGH severity rating because the attack vector is network-based, no authentication is required, the attack complexity is low, and the vulnerability allows confidentiality, integrity, and availability impacts on the database. The score does not account for public disclosure or active exploitation, which elevate practical risk beyond the base score. Organizations should treat this as urgent.

Frequently asked questions