Which versions of PHP are affected by CVE-2026-4909?

Organizations using A weakness should be aware of moderate risk from CVE-2026-4909, a cross-site scripting vulnerability rated CVSS 4.8.

Is there a public PoC exploit available for CVE-2026-4909?

Yes, a public proof-of-concept exploit is available for CVE-2026-4909. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4909?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4909

Q: What is the CVSS score of CVE-2026-4909?

CVE-2026-4909 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16529 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 VulDB

PHP XSS Exam Form Submission Code Projects

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 02:45 euvd

EUVD-2026-16529

Analysis Generated

Mar 27, 2026 - 02:45 vuln.today

CVE Published

Mar 27, 2026 - 02:25 nvd

MEDIUM 4.8

DescriptionCVE.org

A weakness has been identified in code-projects Exam Form Submission 1.0/7.php. This impacts an unknown function of the file /admin/update_s7.php. This manipulation of the argument sname causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_s7.php, potentially compromising administrator sessions and enabling unauthorized actions. Publicly available exploit code exists for this vulnerability, though it requires high-privilege authentication to trigger. The CVSS 2.4 score reflects limited impact (information integrity only) and the requirement for authenticated access and user interaction, but the public availability of working exploit code elevates practical risk.

Technical ContextAI

The vulnerability stems from improper input validation and output encoding in a PHP-based exam management application (code-projects Exam Form Submission). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected or stored XSS flaw where user-supplied data in the sname parameter is rendered in HTML context without sanitization. The affected endpoint /admin/update_s7.php processes form submissions intended for updating examination-related data but fails to encode or validate the sname input before displaying it to administrators. This is a server-side PHP application (cpe:2.3:a:code-projects:exam_form_submission) that lacks contextual output encoding mechanisms.

RemediationAI

No vendor-released patch version is identified at time of analysis; contact code-projects directly via https://code-projects.org/ to request a security update addressing CWE-79 input validation. As interim mitigations: (1) restrict administrative access to /admin/update_s7.php by IP allowlist or authentication layer; (2) implement Content Security Policy (CSP) headers to mitigate XSS payload execution (e.g., script-src 'self'); (3) apply server-side input validation and HTML entity encoding to the sname parameter before any database or output operation; (4) conduct code review of all admin endpoints for similar XSS flaws. Until patched, limit administrative panel access to trusted networks and educate admins not to click external links while logged in.