# CVE-2026-92926: Code Projects Matrimonial System SQL injection in partner preferences

Source: https://junglewise.ai/threats/cve-2026-92926-code-projects-matrimonial-system-sql-injection-in-partner  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92926 · Severity: high · CVSS 7.3 · Published 2026-09-17

The Matrimonial System is a PHP web application used to manage matrimonial profiles and partner preferences. A SQL injection vulnerability in the partner preference form allows attackers to manipulate database queries and extract sensitive data, including user credentials and personal information stored in the system.

Technologies: [Code-Projects Matrimonial System](https://junglewise.ai/threats/technologies/matrimonial-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-92926 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92926 being exploited in the wild.

**How severe is CVE-2026-92926?** High severity, with a CVSS score of 7.3, published 17 September 2026.

**Which products and versions are affected?** Code-Projects Matrimonial System 1.0.

**Is there a fix for CVE-2026-92926?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92926 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92926?** Check whether you run Code-Projects Matrimonial System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a classic SQL injection (CWE-89) in the writepartnerprefs() function within partner_preference.php. User input from the education parameter (and other POST parameters) is directly concatenated into a SQL UPDATE query without sanitization or parameterized prepared statements. The vulnerable code constructs: UPDATE partnerprefs SET education='$education' WHERE custId='$id'. An unauthenticated or authenticated attacker can submit malicious SQL payloads via the education parameter to execute arbitrary SQL queries, enumerate the database, and extract credentials and sensitive data. No patch information is currently available for version 1.0.

## Affected products

- Code Projects Matrimonial System 1.0

## Timeline

- 2026-09-17: disclosed
- 2026-09-25: other: Public proof-of-concept and technical writeup published on GitHub

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/partner_preference/sqli_education/Readme.md](https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/partner_preference/sqli_education/Readme.md)

## Related threats

- [code-projects Matrimonial System hardcoded credentials exposure](https://junglewise.ai/threats/cve-2026-108938-a-flaw-has-been-found-in-code-projects-matrimonial-system-1-0)
- [code-projects Matrimonial System SQL injection in profile creation](https://junglewise.ai/threats/cve-2026-101105-a-vulnerability-was-determined-in-code-projects-matrimonial)
- [code-projects Matrimonial System SQL injection in search](https://junglewise.ai/threats/cve-2026-92366-code-projects-matrimonial-system-sql-injection-in-search)