Which versions of PHP are affected by CVE-2026-4540?

A critical SQL injection vulnerability in the projectworlds Online Notes Sharing System allows unauthenticated attackers to compromise the entire database.

Is there a public PoC exploit available for CVE-2026-4540?

Yes, a public proof-of-concept exploit is available for CVE-2026-4540. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4540?

Within 24 hours: Disable public access to the /login.php endpoint and assess which systems are running the vulnerable version. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the 'Benutzer' parameter and implement network segmentation to restrict database access. Within 30 days: Plan application replacement or major upgrade once patches are released, and conduct a forensic audit for signs of exploitation.

PHP CVE-2026-4540

Q: What is the CVSS score of CVE-2026-4540?

CVE-2026-4540 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14289 MEDIUM

SQL Injection (CWE-89)

2026-03-22 VulDB

PHP SQLi Online Notes Sharing System Projectworlds

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 24, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 08:00 euvd

EUVD-2026-14289

Analysis Generated

Mar 22, 2026 - 08:00 vuln.today

CVE Published

Mar 22, 2026 - 07:41 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument Benutzer results in SQL Injection. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in projectworlds Online Notes Sharing System 1.0 allows unauthenticated remote attackers to manipulate the Benutzer parameter in /login.php, enabling unauthorized data access, modification, or denial of service. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

This vulnerability affects the projectworlds Online Notes Sharing System version 1.0, identified by CPE cpe:2.3:a:projectworlds:online_notes_sharing_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (SQL Injection), a classic input validation failure where user-supplied data in the 'Benutzer' parameter within the Parameters Handler of /login.php is directly incorporated into SQL queries without proper sanitization or parameterized statements. This PHP-based application fails to implement secure coding practices for database interactions at the authentication layer, allowing malicious SQL commands to be injected through the login form.

RemediationAI

Organizations running projectworlds Online Notes Sharing System 1.0 should immediately discontinue use of this software, as the CVSS Remediation Level (RL:X) indicates no official patch is available. As an interim measure, implement a web application firewall (WAF) with SQL injection signatures to filter malicious input to /login.php, specifically monitoring the 'Benutzer' parameter for SQL metacharacters and injection patterns. Restrict access to the application to trusted IP ranges using network-level controls and consider replacing the system with a maintained alternative that follows secure development practices. If the source code is accessible, developers should remediate the vulnerability by implementing parameterized queries or prepared statements for all database interactions in /login.php. Detailed vulnerability analysis is available at https://vuldb.com/?submit.774686 and the exploit at https://github.com/juzidddd/CVE/issues/4 should be reviewed to understand attack patterns for defensive configuration.