# CVE-2026-108938: code-projects Matrimonial System hardcoded credentials exposure

Source: https://junglewise.ai/threats/cve-2026-108938-a-flaw-has-been-found-in-code-projects-matrimonial-system-1-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108938 · Severity: medium · CVSS 5.3 · Published 2026-10-12

The Matrimonial System is a web-based dating and matchmaking platform built in PHP and MySQL. The application's default database installation file contains hardcoded credentials in plaintext, allowing anyone with access to download the source code to obtain valid login credentials and user personal information including birth dates, genders, and email addresses. An attacker can use these credentials to gain unauthorized account access and view sensitive user data without any authentication or exploitation steps.

Technologies: [Code-Projects Matrimonial System](https://junglewise.ai/threats/technologies/matrimonial-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-108938 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108938 being exploited in the wild.

**How severe is CVE-2026-108938?** Medium severity, with a CVSS score of 5.3, published 12 October 2026.

**Which products and versions are affected?** Code-Projects Matrimonial System 1.0.

**Is there a fix for CVE-2026-108938?** No fixed version is recorded yet. Remove all credentials from the distributed SQL dump file and replace them with dummy test credentials. Never store passwords in plaintext; use bcrypt or Argon2id hashing. Rotate any credentials that have been exposed in the publicly available file.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108938 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108938?** Check whether you run Code-Projects Matrimonial System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Remove all credentials from the distributed SQL dump file and replace them with dummy test credentials. Never store passwords in plaintext; use bcrypt or Argon2id hashing. Rotate any credentials that have been exposed in the publicly available file.</anigation>
</invoke>

## Technical details

The vulnerability is an exposure of sensitive information (CWE-200) where plaintext database credentials and user personally identifiable information (PII) are embedded in a publicly distributed SQL dump file (db/matrimony.sql). The attack requires only network access and file download capability; no authentication is needed. An attacker can obtain valid credentials and user data by opening the unencrypted SQL file, leading to unauthorized account access and information disclosure.

## Affected products

- code-projects Matrimonial System 1.0

## Timeline

- 2026-10-12: disclosed

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/Information%20Disclosure/Readme.md](https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/Information%20Disclosure/Readme.md)

## Related threats

- [code-projects Matrimonial System SQL injection in profile creation](https://junglewise.ai/threats/cve-2026-101105-a-vulnerability-was-determined-in-code-projects-matrimonial)
- [Code Projects Matrimonial System SQL injection in partner preferences](https://junglewise.ai/threats/cve-2026-92926-code-projects-matrimonial-system-sql-injection-in-partner)
- [code-projects Matrimonial System SQL injection in search](https://junglewise.ai/threats/cve-2026-92366-code-projects-matrimonial-system-sql-injection-in-search)