Which versions of PHP are affected by CVE-2026-1422?

A high-severity vulnerability in the Online Examination System's login component (CVE-2026-1422) poses a significant risk to user authentication and data security.

Is there a public PoC exploit available for CVE-2026-1422?

Yes, a public proof-of-concept exploit is available for CVE-2026-1422. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1422?

Within 24 hours: Inventory all systems running Online Examination System 1.0 and assess exposure; isolate affected systems from production networks if possible. Within 7 days: Implement WAF rules to block suspicious login requests, enforce multi-factor authentication on administrative accounts, and increase monitoring of /index.php login page for exploitation attempts. Within 30 days: Plan upgrade to patched version immediately upon release, conduct security audit of affected systems, and review logs for unauthorized access attempts.

PHP CVE-2026-1422

Q: What is the CVSS score of CVE-2026-1422?

CVE-2026-1422 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-01-26 cna@vuldb.com

PHP SQLi Online Examination System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Jan 28, 2026 - 14:07 vuln.today

Public exploit code

CVE Published

Jan 26, 2026 - 07:16 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Page. Performing a manipulation of the argument User results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in the login page of code-projects Online Examination System 1.0 allows unauthenticated remote attackers to manipulate the User parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and affects confidentiality, integrity, and availability of the affected system.

Technical ContextAI

Affects Online Examination System. A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Page. Performing a manipulation of the argument User results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.