Which versions of PHP are affected by CVE-2026-4849?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4849, a cross-site scripting vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4849?

Yes, a public proof-of-concept exploit is available for CVE-2026-4849. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4849?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4849

Q: What is the CVSS score of CVE-2026-4849?

CVE-2026-4849 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16138 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 VulDB

GHSA-wgxm-cpjf-429r

PHP XSS Simple Laundry System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 03, 2026 - 17:52 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 08:15 euvd

EUVD-2026-16138

Analysis Generated

Mar 26, 2026 - 08:15 vuln.today

CVE Published

Mar 26, 2026 - 07:41 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /modify.php of the component Parameter Handler. The manipulation of the argument firstName leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

A reflected cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System version 1.0 via the firstName parameter in the /modify.php file. An attacker can inject malicious JavaScript that executes in a victim's browser when they visit a crafted link, potentially leading to session hijacking, credential theft, or malware distribution. A public proof-of-concept is available on GitHub, and exploitation requires only user interaction (clicking a malicious link), making this a practical concern despite the moderate CVSS score of 5.3.

Technical ContextAI

The vulnerability is a classic stored or reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based web application. The Simple Laundry System, identified via CPE (cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), fails to properly sanitize or encode user-supplied input in the firstName parameter before rendering it in the /modify.php component. The Parameter Handler component does not implement adequate output encoding or input validation, allowing arbitrary HTML and JavaScript to be injected into the page context. This is a fundamental web application security flaw where user input is directly passed to the response without escaping special characters that have meaning in HTML/JavaScript contexts.

RemediationAI

The primary remediation is to apply a security patch from code-projects if available; check https://code-projects.org/ for updates to version 1.0 or later. If no official patch exists, implement server-side input validation and output encoding in /modify.php: use PHP's htmlspecialchars() or htmlentities() functions when rendering the firstName parameter in HTML context, or use a templating engine with automatic escaping enabled. Additionally, implement Content Security Policy (CSP) headers to restrict script execution and use prepared statements or parameterized queries if database queries are involved. Until patching is possible, restrict application access via network firewall rules, use a Web Application Firewall (WAF) to detect and block XSS payloads targeting the firstName parameter, and educate users not to click suspicious links to the application. Consider retiring this application if it is no longer actively maintained by code-projects.