Which versions of PHP are affected by CVE-2026-4577?

CVE-2026-4577 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4).

Is there a public PoC exploit available for CVE-2026-4577?

Yes, a public proof-of-concept exploit is available for CVE-2026-4577. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4577?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

PHP CVE-2026-4577

Q: What is the CVSS score of CVE-2026-4577?

CVE-2026-4577 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14384 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-23 VulDB

GHSA-84wf-m6gv-7jp4

PHP XSS Exam Form Submission Code Projects

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

Severity Changed

Apr 24, 2026 - 16:37 NVD

LOW MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

2.4 (LOW) 4.8 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 06:45 euvd

EUVD-2026-14384

Analysis Generated

Mar 23, 2026 - 06:45 vuln.today

CVE Published

Mar 23, 2026 - 06:35 nvd

LOW 2.4

DescriptionCVE.org

A vulnerability was found in code-projects Exam Form Submission 1.0. The affected element is an unknown function of the file /admin/update_s4.php. Performing a manipulation of the argument sname results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s4.php endpoint, where the 'sname' parameter is not properly sanitized before output. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially leading to session hijacking, credential theft, or administrative action abuse. A public proof-of-concept exploit is available, increasing real-world risk despite the low CVSS score of 2.4.

Technical ContextAI

The vulnerability is rooted in Improper Neutralization of Input During Web Page Generation (CWE-79: Cross-site Scripting), a fundamental input validation flaw in PHP-based web applications. The Exam Form Submission application (identified via CPE cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*) fails to apply proper output encoding or input sanitization on the 'sname' parameter before rendering it in the administrative interface at /admin/update_s4.php. This allows attackers to inject raw HTML/JavaScript payloads that bypass client-side and server-side filtering mechanisms, resulting in reflected or stored XSS depending on data persistence. The vulnerability affects PHP-based form handling logic where user-controlled input flows directly into template rendering without parameterized output contexts.

RemediationAI

Immediately upgrade to a patched version if the vendor (code-projects) has released one; check https://code-projects.org/ and VulDB references (https://vuldb.com/?id.352414) for the latest version and security advisory. If no patch is available or the application is legacy/unmaintained, apply input validation and output encoding: use prepared statements and parameterized queries for database operations, implement strict HTML entity encoding on all output (e.g., htmlspecialchars() in PHP with ENT_QUOTES flag), and apply a Web Application Firewall (WAF) rule to block script injection payloads in the 'sname' parameter. Additionally, restrict administrative access via IP whitelisting, enforce multi-factor authentication on admin accounts, and conduct a code audit of similar user-input parameters throughout the application (/admin/update_*.php files) for similar XSS flaws.