Which versions of PHP are affected by CVE-2026-3135?

A high-severity vulnerability in itsourcecode News Portal Project 1.0 allows unauthenticated or low-privileged attackers to exploit the admin category management function, potentially compromising…

Is there a public PoC exploit available for CVE-2026-3135?

Yes, a public proof-of-concept exploit is available for CVE-2026-3135. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3135?

Within 24 hours: Immediately restrict network access to /admin/add-category.php using firewall rules or WAF policies; audit access logs for suspicious activity. Within 7 days: Evaluate feasibility of upgrading to a patched version or migrating to alternative content management solutions; conduct full administrative account audit and reset credentials. Within 30 days: Complete migration to a supported, patched platform or implement comprehensive compensating controls with continuous monitoring; perform security assessment of all admin endpoints.

PHP CVE-2026-3135

Q: What is the CVSS score of CVE-2026-3135?

CVE-2026-3135 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-02-25 cna@vuldb.com

PHP SQLi News Portal Project Clive 21

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 25, 2026 - 20:20 vuln.today

Public exploit code

CVE Published

Feb 25, 2026 - 01:16 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This manipulation of the argument Category causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode News Portal Project 1.0 via the Category parameter in /admin/add-category.php allows unauthenticated remote attackers to manipulate database queries. Public exploit code is available for this vulnerability, and no patch has been released, leaving affected installations vulnerable to data exfiltration, modification, or deletion. The attack requires no user interaction and can be executed over the network with a CVSS score of 7.3.

Technical ContextAI

Affects News Portal Project. A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This manipulation of the argument Category causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.