Submeter #997582: code-projects Matrimonial System IN PHP, CSS, JS, AND MYSQL 1.0 Information Disclosure

A sensitive information disclosure vulnerability exists in the Code-Projects Matrimonial System in PHP, CSS, JS, and MySQL due to the inclusion of sensitive user information and plaintext credentials within the publicly accessible db/matrimony.sql database dump. The SQL file can be accessed without authentication through the application's /db/ directory and opened directly in a text editor, exposing user Personally Identifiable Information (PII), including dates of birth, gender, email addresses, and associated credential information. An unauthenticated attacker who can access the distributed project files may therefore obtain sensitive account data and potentially use exposed credentials to gain unauthorized access to affected accounts or application functionality. The issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — 7.5 (High)

Researchers Information

Researcher - 1

Name: Karan Parelkar

Independent Security Researcher

Email: [email protected]

GitHub: https://github.com/KaranParelkar

LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/

Researcher – 2

Name: Abhishek Pisal

Independent Security Researcher

Email: [email protected]

GitHub: https://github.com/EvilGod108

LinkedIn: https://www.linkedin.com/in/abhishek-pisal-a358bb255/

Researcher – 3

Name: Gaurang Kalyankar

Independent Security Researcher

Email: [email protected]

Linkedin: https://www.linkedin.com/in/gaurang-kalyankar-cybersecurity/

• Fonte: ⚠️ https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/Information%20Disclosure/Readme.md
• Utilizador: KaranParelkar (UID 99714)
• Submissão: 24/09/2026 11h41 (há 18 dias)
• Moderação: 11/10/2026 20h27 (17 days later)
• Estado: Aceite
• Entrada VulDB: 416762 [code-projects Matrimonial System 1.0 db/matrimony.sql Elevação de Privilégios]
• Pontos: 20