CVE-2026-6000: code-projects Online Library Management System information disclosure in SQL backup

Executive brief

A vulnerability in the Online Library Management System allows unauthorized access to sensitive database information. This system is used to manage library catalogs and member records. An attacker could potentially download database backup files, leading to the exposure of internal system data and user information.

Technical details

A sensitive information disclosure vulnerability (CWE-200) exists in code-projects Online Library Management System 1.0. The vulnerability is caused by improper access control (CWE-284) on the SQL Database Backup File Handler component. Specifically, the database backup file located at /sql/library.sql is publicly accessible via the web server. A remote, unauthenticated attacker can exploit this by directly requesting the URL, allowing them to download the SQL schema and potentially sensitive data contained within the backup. Public exploit documentation is available.

Affected products

• code-projects Online Library Management System 1.0

Timeline

• 2026-04-10: disclosed: Vulnerability published on NVD and VulDB

References

• https://code-projects.org/
• https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Online%20Library%20Management%20System%20PHP%20Exposed%20Database%20Backup.md
• https://vuldb.com/submit/793895
• https://vuldb.com/vuln/356554
• https://vuldb.com/vuln/356554/cti