Which versions of PHP are affected by CVE-2026-4835?

Organizations using A security vulnerability should be aware of moderate risk from CVE-2026-4835, a cross-site scripting vulnerability rated CVSS 5.1.

Is there a public PoC exploit available for CVE-2026-4835?

Yes, a public proof-of-concept exploit is available for CVE-2026-4835. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4835?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4835

Q: What is the CVSS score of CVE-2026-4835?

CVE-2026-4835 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16080 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 VulDB

GHSA-w43v-pfh7-6jqq

PHP XSS Accounting System Code Projects

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 02:30 euvd

EUVD-2026-16080

Analysis Generated

Mar 26, 2026 - 02:30 vuln.today

CVE Published

Mar 26, 2026 - 01:52 nvd

MEDIUM 5.1

DescriptionCVE.org

A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my_account/add_costumer.php of the component Web Application Interface. Such manipulation of the argument costumer_name leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in code-projects Accounting System 1.0 within the customer management interface (/my_account/add_costumer.php), where the costumer_name parameter fails to properly sanitize user input. Attackers with low privileges and user interaction can inject malicious JavaScript that will execute in the browsers of other users viewing the affected page, potentially leading to session hijacking, credential theft, or unauthorized actions within the accounting system. A public proof-of-concept exploit is available, significantly increasing the likelihood of real-world exploitation.

Technical ContextAI

The vulnerability is a stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting a PHP-based web application. The root cause is insufficient input validation and output encoding in the /my_account/add_costumer.php component, specifically in the costumer_name parameter handling. The affected product is code-projects Accounting System 1.0, identified via CPE cpe:2.3:a:code-projects:accounting_system:*:*:*:*:*:*:*:*. The vulnerability persists across unspecified versions of the accounting system product line. Unlike reflected XSS, stored XSS payloads are persisted in the application database and executed whenever affected pages are loaded, creating a persistent attack vector that impacts all subsequent users interacting with the poisoned customer record.

RemediationAI

The primary remediation is to upgrade to a patched version of code-projects Accounting System once released by the vendor; consult https://code-projects.org/ for security updates. Immediate interim controls should include implementing input validation on the costumer_name parameter (whitelist alphanumeric characters and safe symbols only), applying HTML entity encoding to all customer name output, enabling Content Security Policy (CSP) headers to restrict inline script execution, and restricting database-level access to the customer records table to trusted application accounts only. Additionally, conduct an audit of existing customer records in the database for injected malicious scripts and purge any detected payloads. For multi-user environments, enforce strong authentication, implement per-user role-based access controls limiting who can add/modify customer records, and enable comprehensive audit logging of all customer data modifications.