Which versions of PHP are affected by CVE-2026-4898?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4898, a cross-site scripting vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4898?

Yes, a public proof-of-concept exploit is available for CVE-2026-4898. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4898?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4898

Q: What is the CVSS score of CVE-2026-4898?

CVE-2026-4898 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16454 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 VulDB

PHP XSS Online Food Ordering System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 21:31 euvd

EUVD-2026-16454

Analysis Generated

Mar 26, 2026 - 21:31 vuln.today

CVE Published

Mar 26, 2026 - 21:08 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /dbfood/contact.php. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

The Online Food Ordering System 1.0 by code-projects contains a reflected cross-site scripting (XSS) vulnerability in the Name parameter of /dbfood/contact.php that allows unauthenticated remote attackers to inject malicious scripts. The vulnerability has a publicly available proof-of-concept and affects all versions of the affected product line. While the CVSS score of 4.3 is moderate, the public availability of exploit code and minimal complexity of attack execution elevate practical risk for instances exposed to the internet.

Technical ContextAI

The vulnerability is rooted in improper input validation and output encoding in a PHP-based web application, specifically classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected component is the contact.php file located in the /dbfood directory, which processes user-supplied input in the Name parameter without adequate sanitization or HTML entity encoding before rendering it in HTTP responses. This allows attackers to inject arbitrary JavaScript code that executes in the context of a victim's browser session. The affected product is code-projects Online Food Ordering System (CPE: cpe:2.3:a:code-projects:online_food_ordering_system:*:*:*:*:*:*:*:*), a PHP-based e-commerce platform for food ordering operations.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations should immediately audit all instances of Online Food Ordering System for exposed contact forms and consider disabling the contact.php functionality or restricting access to trusted IP ranges via firewall rules. For continued operation, implement input validation and output encoding: ensure all user input in the Name parameter is validated against a whitelist of acceptable characters (alphanumeric and basic punctuation only) and encode all output using HTML entity encoding (e.g., htmlspecialchars() in PHP with ENT_QUOTES flag) before rendering in HTML context. Additionally, implement a Content Security Policy (CSP) header with script-src 'self' to mitigate XSS impact. Contact code-projects for patch availability or consider migrating to a maintained food ordering platform with active security support.