Which versions of PHP are affected by CVE-2026-4969?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4969, a cross-site scripting vulnerability rated CVSS 5.1.

Is there a public PoC exploit available for CVE-2026-4969?

Yes, a public proof-of-concept exploit is available for CVE-2026-4969. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4969?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4969

Q: What is the CVSS score of CVE-2026-4969?

CVE-2026-4969 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16760 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 VulDB

PHP XSS Social Networking Site Code Projects

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 19:00 euvd

EUVD-2026-16760

Analysis Generated

Mar 27, 2026 - 19:00 vuln.today

CVE Published

Mar 27, 2026 - 18:24 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component Alert Handler. The manipulation of the argument content leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Social Networking Site 1.0 allows authenticated remote attackers to inject malicious scripts via the content parameter in the Alert Handler component (/home.php), requiring user interaction to trigger. The vulnerability carries a CVSS score of 5.1 (medium) with publicly available exploit code, though no confirmed active exploitation in the wild has been reported. Affected users can have their sessions hijacked or credentials stolen if they interact with malicious alerts crafted by authenticated attackers.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a well-documented class of web application flaws where user-supplied input is not adequately sanitized before being rendered in HTML context. The affected product, code-projects Social Networking Site (CPE: cpe:2.3:a:code-projects:social_networking_site:*:*:*:*:*:*:*:*), is a PHP-based social networking application. The Alert Handler component in /home.php fails to encode or filter the content parameter before storing it in a database and subsequently rendering it to users, enabling attackers with login credentials to inject arbitrary JavaScript that executes in victims' browsers. The stored nature of this XSS means the payload persists and affects multiple users across sessions.

RemediationAI

Upgrade code-projects Social Networking Site to a patched version released by the vendor (exact patched version number not specified in available advisories; contact https://code-projects.org/ for availability). Until patching is possible, implement input validation and output encoding: sanitize the content parameter using a whitelist of allowed HTML tags (e.g., via HTML Purifier library) and apply context-appropriate output encoding (HTML entity encoding for alert display). Additionally, enforce Content Security Policy (CSP) headers to restrict inline script execution, limit user permissions to create or modify alerts to trusted administrators, and implement a Web Application Firewall (WAF) rule to detect and block common XSS payloads in the content parameter. See VulDB reference https://vuldb.com/?id.353856 and GitHub POC at https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20PHP%20Social%20Networking%20Site.md for technical details.