Which versions of PHP are affected by CVE-2026-4356?

CVE-2026-4356 is a low-severity vulnerability in A flaw involving cross-site scripting (CVSS 2.4).

Is there a public PoC exploit available for CVE-2026-4356?

Yes, a public proof-of-concept exploit is available for CVE-2026-4356. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4356?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

PHP CVE-2026-4356

Q: What is the CVSS score of CVE-2026-4356?

CVE-2026-4356 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12706 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 VulDB

PHP XSS University Management System Itsourcecode

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

Severity Changed

Apr 22, 2026 - 21:37 NVD

LOW MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

2.4 (LOW) 4.8 (MEDIUM)

PoC Detected

Mar 18, 2026 - 14:52 vuln.today

Public exploit code

EUVD ID Assigned

Mar 18, 2026 - 01:30 euvd

EUVD-2026-12706

Analysis Generated

Mar 18, 2026 - 01:30 vuln.today

CVE Published

Mar 18, 2026 - 01:02 nvd

LOW 2.4

DescriptionCVE.org

A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add_result.php. Executing a manipulation of the argument vr can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

A Cross-Site Scripting (XSS) vulnerability exists in itsourcecode University Management System version 1.0, specifically in the /add_result.php file where the 'vr' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions within the application. A public proof-of-concept exploit is available on GitHub, and while the CVSS score is low (2.4), the vulnerability is actively documented in security databases and poses a real risk in educational environments.

Technical ContextAI

The vulnerability is a Reflected or Stored Cross-Site Scripting (CWE-79) flaw in a PHP-based web application. The University Management System processes user input from the 'vr' parameter in /add_result.php without adequate output encoding or input validation, allowing attackers to inject arbitrary HTML and JavaScript code. The affected product is identified via CPE cpe:2.3:a:itsourcecode:university_management_system:*:*:*:*:*:*:*:* and is built on PHP, a server-side scripting language commonly used in educational management platforms. This represents a classic failure to implement proper encoding mechanisms (such as HTML entity encoding) before rendering user-supplied data in web responses.

RemediationAI

The primary remediation is to contact itsourcecode for an updated version of the University Management System or a security patch addressing the XSS vulnerability in /add_result.php. Until an official patch is available, implement compensating controls by applying strict input validation and output encoding to the 'vr' parameter using PHP functions such as htmlspecialchars() or htmlentities() to prevent XSS injection. Additionally, enforce Content Security Policy (CSP) headers to restrict script execution, implement HTTP-only and Secure flags on session cookies to mitigate session hijacking, and restrict access to /add_result.php to only authorized administrative users via firewall rules or application-level access controls. A Web Application Firewall (WAF) with XSS detection rules can provide temporary protection while awaiting vendor patches. Refer to VulDB advisory at https://vuldb.com/?id.351395 for additional technical details.