Which versions of PHP are affected by CVE-2026-4844?

A critical SQL injection vulnerability in our Online Food Ordering System's admin portal allows unauthenticated attackers to compromise our entire database, potentially exposing customer data,…

Is there a public PoC exploit available for CVE-2026-4844?

Yes, a public proof-of-concept exploit is available for CVE-2026-4844. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4844?

Within 24 hours: Take the admin login module offline or restrict access to a whitelist of internal IP addresses only; enable enhanced logging and begin forensic review for signs of compromise. Within 7 days: Deploy a Web Application Firewall (WAF) rule to block SQL injection patterns on the /admin.php file and implement input validation as a temporary fix; coordinate with the vendor for patch timeline. Within 30 days: Apply the vendor patch immediately upon release, conduct a full security audit of the application, reset all admin credentials, and review database access logs for unauthorized activity.

PHP CVE-2026-4844

Q: What is the CVSS score of CVE-2026-4844?

CVE-2026-4844 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16114 MEDIUM

SQL Injection (CWE-89)

2026-03-26 VulDB

PHP SQLi Online Food Ordering System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 05:15 euvd

EUVD-2026-16114

Analysis Generated

Mar 26, 2026 - 05:15 vuln.today

CVE Published

Mar 26, 2026 - 04:50 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in code-projects Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin.php of the component Admin Login Module. The manipulation of the argument Username results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

AnalysisAI

SQL injection in the Admin Login Module of code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in /admin.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations should implement network-level controls or upgrade to a patched version once available.

Technical ContextAI

This vulnerability affects code-projects Online Food Ordering System version 1.0 (CPE: cpe:2.3:a:code-projects:online_food_ordering_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing food orders. The root cause is CWE-89 (SQL Injection), where user-supplied input from the Username parameter in the admin.php authentication module is passed directly to SQL queries without proper sanitization or parameterized statements. This allows attackers to inject arbitrary SQL commands that are executed by the backend database, potentially bypassing authentication mechanisms and manipulating database operations. The vulnerability exists in the Admin Login Module, a critical component responsible for administrative access control.

RemediationAI

No official vendor patch or updated version has been released for this vulnerability as of the available intelligence. Organizations should immediately isolate affected systems from public networks and implement web application firewall (WAF) rules to block SQL injection attempts targeting the /admin.php endpoint, specifically filtering malicious input patterns in the Username parameter. Implement IP-based access controls restricting administrative interface access to trusted networks only. Deploy input validation and parameterized queries as code-level mitigations if source code modification is possible. Consider replacing this software with a maintained alternative with active security support, as the lack of vendor response suggests limited security maintenance. Monitor the VulDB entries (https://vuldb.com/?id.353149, https://vuldb.com/?ctiid.353149) and vendor site for future updates.