What is the CVSS score of CVE-2026-2158?

CVE-2026-2158 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-2158?

A high-severity vulnerability in the Student Web Portal authentication system (CVE-2026-2158) could allow unauthorized access to student records and portal functionality.

Is there a public PoC exploit available for CVE-2026-2158?

Yes, a public proof-of-concept exploit is available for CVE-2026-2158. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2158?

Within 24 hours: Isolate the affected Student Web Portal from production or restrict network access to trusted IPs only; establish 24/7 monitoring for exploitation attempts on /check_user.php. Within 7 days: Deploy WAF rules to block suspicious requests to /check_user.php; conduct forensic audit of access logs for evidence of compromise. Within 30 days: Contact vendor for patch timeline; develop migration plan to alternative portal solution if patch timeline exceeds 60 days.

PHP CVE-2026-2158

HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-02-08 cna@vuldb.com

PHP SQLi Student Web Portal Carmelo

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 11, 2026 - 18:44 vuln.today

Public exploit code

CVE Published

Feb 08, 2026 - 15:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely.

AnalysisAI

SQL injection in the Student Web Portal 1.0 /check_user.php endpoint allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. The vulnerability enables attackers to read, modify, or delete sensitive data with public exploit code readily available. This affects PHP-based installations of the Student Web Portal with no patch currently available.

Technical ContextAI

Affects Student Web Portal. A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.