Which versions of PHP are affected by CVE-2026-3759?

A high-severity vulnerability in projectworlds Online Art Gallery Shop 1.0 allows unauthenticated attackers to potentially compromise the admin panel, with public exploits already available.

Is there a public PoC exploit available for CVE-2026-3759?

Yes, a public proof-of-concept exploit is available for CVE-2026-3759. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3759?

Within 24 hours: Isolate affected systems from production networks or restrict admin panel access to trusted IP ranges only. Within 7 days: Conduct a security audit to determine if the vulnerability has been exploited, review admin access logs, and contact the vendor for patch availability and timeline. Within 30 days: Deploy a Web Application Firewall (WAF) with rules blocking exploitation attempts, implement multi-factor authentication on admin accounts, and migrate to a patched version or alternative solution if the vendor cannot provide timely remediation.

PHP CVE-2026-3759

Q: What is the CVSS score of CVE-2026-3759?

CVE-2026-3759 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-08 cna@vuldb.com

PHP SQLi Online Art Gallery Shop Projectworlds

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 16:31 vuln.today

Public exploit code

CVE Published

Mar 08, 2026 - 19:16 nvd

HIGH 7.3

DescriptionCVE.org

A security vulnerability has been detected in projectworlds Online Art Gallery Shop 1.0. This affects an unknown part of the file /admin/adminHome.php. Such manipulation of the argument reach_nm leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in projectworlds Online Art Gallery Shop 1.0 via the reach_nm parameter in /admin/adminHome.php allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify database contents. Public exploit code exists for this vulnerability, increasing exploitation risk. No patch is currently available for affected installations.

Technical ContextAI

Affects Online Art Gallery Shop. A security vulnerability has been detected in projectworlds Online Art Gallery Shop 1.0. This affects an unknown part of the file /admin/adminHome.php. Such manipulation of the argument reach_nm leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.