CVE-2026-1688

A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
References
Link Resource
https://github.com/jackhong1236/CVE_1/issues/1 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.343482 Permissions Required VDB Entry
https://vuldb.com/?id.343482 Third Party Advisory VDB Entry
https://vuldb.com/?submit.741283 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:clive_21:directory_management_system:1.0:*:*:*:*:*:*:*

History

13 Feb 2026, 18:07

Type Values Removed Values Added
CPE cpe:2.3:a:clive_21:directory_management_system:1.0:*:*:*:*:*:*:*
First Time Clive 21
Clive 21 directory Management System
References () https://github.com/jackhong1236/CVE_1/issues/1 - () https://github.com/jackhong1236/CVE_1/issues/1 - Exploit, Issue Tracking, Mitigation, Third Party Advisory
References () https://itsourcecode.com/ - () https://itsourcecode.com/ - Product
References () https://vuldb.com/?ctiid.343482 - () https://vuldb.com/?ctiid.343482 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.343482 - () https://vuldb.com/?id.343482 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.741283 - () https://vuldb.com/?submit.741283 - Third Party Advisory, VDB Entry

30 Jan 2026, 16:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-01-30 16:16

Updated : 2026-02-13 18:07


NVD link : CVE-2026-1688

Mitre link : CVE-2026-1688

CVE.ORG link : CVE-2026-1688


JSON object : View

Products Affected

clive_21

  • directory_management_system
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')