Is there a public PoC exploit available for CVE-2026-13504?

Yes, a public proof-of-concept exploit is available for CVE-2026-13504. Prioritise patching immediately. EPSS: 0.2%.

Project Management System CVE-2026-13504

Q: What is the CVSS score of CVE-2026-13504?

CVE-2026-13504 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40002 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-28 VulDB

GHSA-7252-h5v6-wx9v

PHP XSS Project Management System Code Projects

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Network-accessible XSS requiring authenticated low-privilege user and victim interaction; no confidentiality or availability impact confirmed; scope unchanged per 4.0 SC:N.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 28, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jun 28, 2026 - 16:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jun 28, 2026 - 16:15 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component Mail Compose Page. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

AnalysisAI

Cross-site scripting in code-projects Project Management System 1.0 allows a remote authenticated attacker to inject malicious scripts via the /mail.php Mail Compose Page, targeting other users who interact with the crafted mail content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires a low-privileged authenticated session and passive victim interaction, limiting scope but not eliminating risk in shared environments. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing and no vendor patch have been identified at time of analysis.

Technical ContextAI

The affected component is the Mail Compose Page at /mail.php within the PHP-based code-projects Project Management System 1.0, identified by CPE cpe:2.3:a:code-projects:project_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input to the mail compose form is rendered in the browser without adequate sanitization or output encoding. This class of vulnerability in PHP applications typically arises from direct interpolation of POST/GET parameters into HTML output without htmlspecialchars() or equivalent escaping. The wildcard CPE version field suggests no version range has been narrowed beyond 1.0, and code-projects.org is the originating vendor.

RemediationAI

No vendor-released patch has been identified at time of analysis. The VulDB entry at https://vuldb.com/vuln/374499 is the primary public disclosure reference. As an immediate compensating control, administrators should disable or restrict access to the /mail.php Mail Compose Page via web server configuration (e.g., deny rule in .htaccess or nginx location block), accepting the trade-off of losing internal mail functionality. If mail compose must remain available, implement a server-side output encoding layer for all parameters rendered in HTML, using PHP's htmlspecialchars() with ENT_QUOTES before echo or print. Input validation (allowlisting expected characters) on compose fields provides defense-in-depth but is not a substitute for output encoding. Monitor the vendor site at code-projects.org and the VulDB advisory at https://vuldb.com/cve/CVE-2026-13504 for patch release notifications.