Is there a public PoC exploit available for CVE-2026-10170?

Yes, a public proof-of-concept exploit is available for CVE-2026-10170. Prioritise patching immediately. EPSS: 0.0%.

Visitor Management System CVE-2026-10170

Q: What is the CVSS score of CVE-2026-10170?

CVE-2026-10170 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33490 LOW

SQL Injection (CWE-89)

2026-05-31 VulDB

GHSA-g637-c245-w6r2

PHP SQLi Visitor Management System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 31, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

May 31, 2026 - 07:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 31, 2026 - 06:59 vuln.today

DescriptionCVE.org

A flaw has been found in code-projects Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /vms/php/phone_0.php. This manipulation of the argument phone causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in code-projects Visitor Management System 1.0 exposes the /vms/php/phone_0.php endpoint to database manipulation via the unsanitized phone parameter, exploitable by authenticated remote attackers. A publicly available exploit chain on GitHub (by Xmyronn) explicitly demonstrates escalation from this SQL injection to remote code execution, elevating the real-world severity beyond the CVSS 6.3 base score. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), but the published RCE chain makes this a meaningful risk for any internet-exposed deployment.

Technical ContextAI

The affected product is a PHP-based web application for managing visitor records, identified via CPE cpe:2.3:a:code-projects:visitor_management_system:*:*:*:*:*:*:*:* from code-projects.org. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the phone argument passed to /vms/php/phone_0.php is incorporated directly into a backend SQL query without proper parameterization or escaping. PHP applications that construct SQL queries via string concatenation rather than prepared statements are classically vulnerable to this pattern. The publicly available exploit repository title ('SQLi to Remote Code Execution Attack Chain') implies the injection permits stacked queries or file-write primitives (e.g., INTO OUTFILE) that enable webshell deployment - a well-known MySQL/PHP escalation path.

RemediationAI

No vendor-released patch has been identified at time of analysis. code-projects.org does not appear to have published a security advisory or updated release addressing this issue. The immediate primary mitigation is to restrict access to /vms/php/phone_0.php at the web server or firewall level, allowing only trusted internal IP ranges - this removes network reachability entirely but may break legitimate phone-lookup functionality. A Web Application Firewall (WAF) rule blocking SQL metacharacters (single quotes, comment sequences, UNION/SELECT keywords) in the phone parameter provides partial protection but can be bypassed by skilled attackers and should not be considered a primary control. Developers should refactor the vulnerable file to use PHP PDO or MySQLi prepared statements with bound parameters, eliminating the injection point at the code level. If the application is publicly internet-facing, consider taking it offline until a code-level fix is applied, given the published RCE chain. The VulDB submission at https://vuldb.com/submit/819186 and exploit details at the GitHub repository (https://github.com/Xmyronn/Visitor-Management-System-1.0---SQLi-to-Remote-Code-Execution-Attack-Chain-.git) can assist defenders in reproducing and validating mitigations.