CVE-2026-108938

5.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-425, CWE-552

Impact

Remote, unauthenticated attackers can download the application's database dump via direct HTTP requests. This exposes all stored application and user data.

Root cause

The database backup file db/matrimony.sql is stored directly in the publicly accessible web root without access controls.

Affected systems

code-projects Matrimonial System 1.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

No official patch version is documented. Move db/matrimony.sql out of the web server document root or configure your web server to deny access to .sql files.

shell

$ rm -f /path/to/webroot/db/matrimony.sql

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been published and may be used.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108938