Which versions of PHP are affected by CVE-2026-4850?

Organizations using A security flaw should be aware of notable risk from CVE-2026-4850, a SQL injection vulnerability rated CVSS 6.9.

Is there a public PoC exploit available for CVE-2026-4850?

Yes, a public proof-of-concept exploit is available for CVE-2026-4850. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4850?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4850

Q: What is the CVSS score of CVE-2026-4850?

CVE-2026-4850 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16141 MEDIUM

SQL Injection (CWE-89)

2026-03-26 VulDB

GHSA-f772-529f-894q

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 17:51 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 08:15 euvd

EUVD-2026-16141

Analysis Generated

Mar 26, 2026 - 08:15 vuln.today

CVE Published

Mar 26, 2026 - 07:41 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checkregisitem.php of the component Parameter Handler. The manipulation of the argument Long-arm-shirtVol results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attackers to manipulate the Long-arm-shirtVol argument and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available to remediate this issue.

Technical ContextAI

The vulnerability is a classic SQL injection vulnerability (CWE-89) occurring in a PHP-based parameter handler. The affected product, code-projects Simple Laundry System 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), fails to properly sanitize user-supplied input before incorporating it into SQL queries. The Long-arm-shirtVol parameter is passed directly to database queries without parameterized statements or input validation, allowing an attacker to break out of the intended SQL context and execute arbitrary commands. This is a fundamental input validation flaw in a legacy PHP application typically used for laundry management operations.

RemediationAI

The primary remediation is to upgrade code-projects Simple Laundry System to a patched version if available from code-projects.org; however, given the legacy status of version 1.0, vendor patch availability should be verified immediately. If no patch exists, consider migrating to an actively maintained alternative laundry management system. As an interim mitigation, restrict network access to the /checkregisitem.php endpoint using a Web Application Firewall (WAF) configured to block SQL injection patterns, implement input validation and parameterized queries (prepared statements) at the application level if code modification is feasible, and ensure database user accounts have minimal necessary privileges to limit damage from successful injection attacks. Monitor database logs for suspicious SQL activity. Additionally, disable or remove the application entirely if it is no longer actively maintained or supported.