# CVE-2026-5829: code-projects Simple IT Discussion Forum SQL injection in content.php

Source: https://junglewise.ai/threats/cve-2026-5829-code-projects-simple-it-discussion-forum-sql-injection-in-content  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5829 · Severity: high · CVSS 7.3 · Published 2026-04-09

Simple IT Discussion Forum is a web-based application used to host online community discussions. A security flaw in the way the application handles forum post requests allows an attacker to gain unauthorized access to the underlying database. This could result in the theft of sensitive user information, modification of forum content, or a complete disruption of the service.

Technologies: [Code-Projects Simple IT Discussion Forum](https://junglewise.ai/threats/technologies/simple-it-discussion-forum). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-5829 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5829 being exploited in the wild.

**How severe is CVE-2026-5829?** High severity, with a CVSS score of 7.3, published 9 April 2026.

**Which products and versions are affected?** Code-Projects Simple IT Discussion Forum 1.0.

**Is there a fix for CVE-2026-5829?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5829 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-5829?** Check whether you run Code-Projects Simple IT Discussion Forum at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in code-projects Simple IT Discussion Forum 1.0 within the '/pages/content.php' component. The root cause is the failure to properly sanitize or validate the 'post_id' GET parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests containing SQL payloads (including boolean-based blind, time-based blind, and UNION-based techniques). Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public proof-of-concept (PoC) using sqlmap has been disclosed.

## Affected products

- code-projects Simple IT Discussion Forum 1.0

## Timeline

- 2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-09: advisory: CVE-2026-5829 published.

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/lonelyuan/vunls/issues/6](https://github.com/lonelyuan/vunls/issues/6)
- [https://vuldb.com/submit/788338](https://vuldb.com/submit/788338)
- [https://vuldb.com/vuln/356276](https://vuldb.com/vuln/356276)
- [https://vuldb.com/vuln/356276/cti](https://vuldb.com/vuln/356276/cti)

## Related threats

- [code-projects Simple IT Discussion Forum SQL injection in addcomment.php](https://junglewise.ai/threats/cve-2026-5828-code-projects-simple-it-discussion-forum-sql-injection-in)
- [code-projects Simple IT Discussion Forum SQL injection in question-function.php](https://junglewise.ai/threats/cve-2026-5827-code-projects-simple-it-discussion-forum-sql-injection-in-question)
- [code-projects Simple IT Discussion Forum XSS in edit-category.php](https://junglewise.ai/threats/cve-2026-5826-code-projects-simple-it-discussion-forum-xss-in-edit-category-php)
- [code-projects Simple IT Discussion Forum SQL injection in edit-category.php](https://junglewise.ai/threats/cve-2026-5672-code-projects-simple-it-discussion-forum-sql-injection-in-edit)