CVE-2026-76799
Received Received - Intake

Path Traversal in Login Registration System 1.0

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulDB

Description
A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation causes files or directories accessible. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76799
EUVD
EUVD-2026-63191

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects login_registration_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-425 The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an exposed database backup file in the Login Registration System 1.0. An attacker can remotely access and download the file located at /loginsystem/database/login_registration_system.sql without authentication. The file contains sensitive user data like names, emails, and plaintext passwords, allowing further attacks such as credential reuse.

Detection Guidance

Check if the file /loginsystem/database/login_registration_system.sql is accessible via a web browser or tools like curl. Use commands such as 'curl http://[target]/loginsystem/database/login_registration_system.sql' or 'wget http://[target]/loginsystem/database/login_registration_system.sql' to attempt downloading the file. Verify if directory listing is enabled by accessing /loginsystem/database/ directly.

Impact Analysis

An attacker could exploit this to steal sensitive user data, including plaintext passwords, leading to account compromise, identity theft, or unauthorized access to other systems. The exposed database structure may also enable further attacks like account enumeration or credential stuffing.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if health-related data is exposed. It results in non-compliance with data protection requirements, potentially leading to legal penalties, fines, and reputational damage.

Mitigation Strategies

Remove the exposed backup file from the web-accessible directory immediately. Disable directory listing on the web server. Move sensitive backups outside the web root directory. Implement strong password hashing for stored credentials. Restrict access to sensitive files and directories through proper server configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart