Which versions of PHP are affected by CVE-2026-3758?

A high-severity vulnerability in projectworlds Online Art Gallery Shop 1.0 affects the admin panel and has active public exploits available, creating immediate risk of unauthorized administrative…

Is there a public PoC exploit available for CVE-2026-3758?

Yes, a public proof-of-concept exploit is available for CVE-2026-3758. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3758?

Within 24 hours: Take the affected admin panel offline or restrict access to trusted IP addresses only; verify no unauthorized access has occurred by reviewing admin logs. Within 7 days: Contact projectworlds for patch status and estimated availability; implement Web Application Firewall rules to block exploitation attempts against /admin/adminHome.php. Within 30 days: Apply vendor patch immediately upon release; if no patch is provided, evaluate alternative gallery solutions and plan migration.

PHP CVE-2026-3758

Q: What is the CVSS score of CVE-2026-3758?

CVE-2026-3758 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-08 cna@vuldb.com

PHP SQLi Online Art Gallery Shop Projectworlds

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 16:31 vuln.today

Public exploit code

CVE Published

Mar 08, 2026 - 19:16 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in projectworlds Online Art Gallery Shop 1.0. Affected by this issue is some unknown functionality of the file /admin/adminHome.php. This manipulation of the argument Info causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in projectworlds Online Art Gallery Shop 1.0 allows unauthenticated remote attackers to manipulate the Info parameter in /admin/adminHome.php, potentially enabling unauthorized database access and data theft. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available, requiring organizations to implement compensating controls or upgrade to a patched version when released.

Technical ContextAI

Affects Online Art Gallery Shop. A weakness has been identified in projectworlds Online Art Gallery Shop 1.0. Affected by this issue is some unknown functionality of the file /admin/adminHome.php. This manipulation of the argument Info causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.