Read the docs
TI-2026-06267 Aliases CVE-2026-7144GHSA-grjf-7388-xj3g

1000 Projects Portfolio Management System MCA update_passwd_process.php authorization

Priority MEDIUM 57CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown function of the file update_passwd_process.php. The manipulation of the argument temp_user results in authorization bypass. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00215 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1000 ProjectsPortfolio Management System MCA1.0—No fix listedCNA
  • Portfolio Management System MCA Vendor1000 Projects Affected 1.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:1000projects:portfolio_management_system_mca:*:*:*:*:*:*:*:*——1000 Projects
  • cpe:2.3:a:1000projects:portfolio_management_system_mca:*:*:*:*:*:*:*:* Versions — — ·1000 Projects

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7144
  2. 2026-10-03 Alias added: GHSA-grjf-7388-xj3g

References

Exploit 1

Other 1

  • TI-2024-36849 A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL… CVSS 3.1CRITICAL 9.1
  • TI-2025-09111 1000projects Beauty Parlour Management System contact-us.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-07541 1000 Projects ABC Courier Management System report.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-07478 1000 Projects ABC Courier Management System Add_reciver.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-09923 1000projects Bookstore Management System login.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-09558 1000projects Online Student Project Report Submission and Evaluation System student_controller.php unrestricted upload CVSS 4.0MEDIUM 6.9
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences