CVE-2026-30520

A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save_loan action). The application fails to properly sanitize user input supplied to the "borrower_id" parameter in a POST request, allowing an authenticated attacker to inject malicious SQL commands.

• CWE-89

• https://github.com/meifukun/Web-Security-PoCs/blob/main/Loan-Management-System/SQLi-SaveLoan-borrowerId.mdExploit, Third Party Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30495The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.…8.8
• CVE-2026-30496The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.…9.8
• CVE-2026-30498A Cross-Site Request Forgery (CSRF) vulnerability was discov…6.3
• CVE-2026-3050A flaw has been found in horilla-opensource horilla up to 1.…5.4
• CVE-2026-3051A vulnerability has been found in DataLinkDC dinky up to 1.2…7.6
• CVE-2026-3052A vulnerability was found in DataLinkDC dinky up to 1.2.5. T…7.7
• CVE-2026-30521A Business Logic vulnerability exists in SourceCodester Loan…6.5
• CVE-2026-30522A Business Logic vulnerability exists in SourceCodester Loan…6.5
• CVE-2026-30523A Business Logic vulnerability exists in SourceCodester Loan…6.5
• CVE-2026-30526A Reflected Cross-Site Scripting (XSS) vulnerability exists …6.1
• CVE-2026-30527A Stored Cross-Site Scripting (XSS) vulnerability exists in …5.4
• CVE-2026-30529A SQL Injection vulnerability exists in SourceCodester Onlin…8.8