Which versions of PHP are affected by CVE-2026-4533?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4533, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4533?

Yes, a public proof-of-concept exploit is available for CVE-2026-4533. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4533?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4533

Q: What is the CVSS score of CVE-2026-4533?

CVE-2026-4533 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14271 LOW

SQL Injection (CWE-89)

2026-03-22 VulDB

PHP SQLi Simple Food Ordering System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 02, 2026 - 20:51 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 02:30 euvd

EUVD-2026-14271

Analysis Generated

Mar 22, 2026 - 02:30 vuln.today

CVE Published

Mar 22, 2026 - 02:02 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file all-tickets.php. The manipulation of the argument Status results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to manipulate the Status parameter in all-tickets.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to read, modify, or delete database contents. The affected PHP application currently lacks a security patch.

Technical ContextAI

This vulnerability is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) arising from inadequate input sanitization in a PHP-based web application. The Simple Food Ordering System, identified via CPE cpe:2.3:a:code-projects:simple_food_ordering_system:*:*:*:*:*:*:*:*, processes user-supplied input in the Status parameter of the all-tickets.php endpoint without sufficient parameterized query protection or input validation. The publicly available exploit demonstrates time-based blind SQL injection, a technique where attackers infer database contents through conditional time delays in SQL responses, allowing data exfiltration without direct error-based feedback. The vulnerability requires authentication (PR:L in CVSS vector), indicating it affects logged-in users, typically reducing but not eliminating practical risk in multi-user environments.

RemediationAI

Immediately contact code-projects or check https://code-projects.org/ for a security patch or updated version of Simple Food Ordering System that addresses the SQL injection in all-tickets.php; if a patch is available, upgrade without delay. As an interim mitigation pending patch availability, implement Web Application Firewall (WAF) rules to block requests containing SQL injection payloads in the Status parameter (such as time-delay keywords like SLEEP, BENCHMARK, or WAITFOR), restrict database account permissions to least-privilege access, and enforce parameterized queries or prepared statements in the all-tickets.php code if a vendor patch is unavailable. For defense-in-depth, restrict access to the affected endpoint to trusted IP ranges or require additional authentication layers (e.g., multi-factor authentication) for users accessing ticket management functions. Monitor database logs for suspicious query patterns and audit application logs for unusual Status parameter values.