What is the CVSS score of CVE-2026-2173?

CVE-2026-2173 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-2173?

A high-severity vulnerability in the Online Examination System's login functionality could allow attackers to gain unauthorized access to student and staff accounts, potentially compromising…

How to fix or mitigate CVE-2026-2173?

Within 24 hours: Inventory all systems running code-projects Online Examination System 1.0 and isolate affected instances from production networks if possible; enable enhanced logging on login.php and monitor for suspicious authentication attempts. Within 7 days: Deploy Web Application Firewall (WAF) rules to restrict access to login.php, implement IP whitelisting for administrative access, and conduct a security audit of recent login logs for indicators of compromise. Within 30 days: Establish direct contact with vendor for patch timeline; if unavailable, develop migration plan to alternative examination platform and complete transition before semester end.

PHP CVE-2026-2173

HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-02-08 cna@vuldb.com

PHP SQLi Online Examination System Fabian

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 08, 2026 - 19:16 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely.

AnalysisAI

SQL injection in code-projects Online Examination System 1.0 allows unauthenticated remote attackers to manipulate the username and password parameters in login.php, potentially enabling unauthorized access to sensitive data or system compromise. The vulnerability requires no user interaction and can be exploited over the network with low complexity. No patch is currently available for this issue.

Technical ContextAI

Affects Online Examination System. A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.