{"id":"CVE-2024-40402","aliases":["EUVD-2024-38440","GHSA-rxq4-2x44-7fjp"],"status":"published","title":"A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management...","description":"A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00367,"percentile":0.30778,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2024-07-17T00:00:00Z","modified":"2026-06-17T07:45:49Z","products":[{"vendor":"nikhil-bhalerao","product":"simple_library_management_system"},{"vendor":"sourcecodester","product":"simple_library_management_system"}],"references":[{"url":"https://github.com/CveSecLook/cve/issues/49","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40402"},{"url":"https://github.com/advisories/GHSA-rxq4-2x44-7fjp"}],"sources":{"cve":[{"id":"CVE-2024-40402","description":"A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries.","status":"published","published":"2024-07-17T00:00:00Z","modified":"2024-08-02T04:33:11.667Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2024-38440","description":"A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries.","status":"published","published":"2024-07-17T00:00:00Z","modified":"2024-08-02T04:33:11Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:16.930013Z"}],"ghsa":[{"id":"GHSA-rxq4-2x44-7fjp","title":"A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management...","description":"A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries.","status":"published","published":"2024-07-17T21:31:38Z","modified":"2024-08-01T15:33:12Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:57:49.277059Z"}],"nvd":[{"id":"CVE-2024-40402","description":"A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries.","status":"published","published":"2024-07-17T20:15:06.507Z","modified":"2026-06-17T07:45:49.993Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:13.413515Z"}]}}