Which versions of PHP are affected by CVE-2026-5010?

CVE-2026-5010 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 5.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users.. A patch is available.

How to fix or mitigate CVE-2026-5010?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-5010

Q: What is the CVSS score of CVE-2026-5010?

CVE-2026-5010 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16660 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 INCIBE

GHSA-jcp9-3x5h-m222

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 14:45 euvd

EUVD-2026-16660

Analysis Generated

Mar 27, 2026 - 14:45 vuln.today

Patch released

Mar 27, 2026 - 14:45 nvd

Patch available

CVE Published

Mar 27, 2026 - 14:35 nvd

MEDIUM 5.1

DescriptionCVE.org

A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user’s behalf.

AnalysisAI

Clickedu contains a reflected XSS vulnerability in the /user.php/ endpoint that permits remote attackers to execute arbitrary JavaScript in a victim's browser via malicious URL parameters, enabling session hijacking, credential theft, and unauthorized actions. The vulnerability affects all versions of Sanoma's Clickedu product (per CPE cpe:2.3:a:sanoma:clickedu:*:*:*:*:*:*:*:*) and a vendor patch is available. No CVSS score or active exploitation data was provided; however, the reflected XSS attack vector combined with educational platform context indicates moderate to high real-world risk given typical user trust in institutional URLs.

Technical ContextAI

This vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw where user-supplied input via URL parameters is rendered in HTML responses without proper sanitization or encoding. The affected application is Sanoma's Clickedu (identified via CPE cpe:2.3:a:sanoma:clickedu:*:*:*:*:*:*:*:*), a PHP-based educational platform. The /user.php/ endpoint fails to validate, filter, or HTML-encode attacker-controlled input before reflecting it back to the client, allowing injection of malicious JavaScript that executes in the context of the victim's authenticated session within the Clickedu application. This is a client-side execution flaw in a server-side rendered PHP application, typical of web applications that do not implement Content Security Policy (CSP) or proper output encoding frameworks.

RemediationAI

Apply the vendor-released patch from Sanoma as documented in the INCIBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-sanomas-clickedu-0). Until patching is completed, implement input validation and output encoding at the /user.php/ endpoint to neutralize XSS payloads-specifically, HTML-encode all user-supplied parameters before rendering them in HTTP responses, and implement a Content Security Policy (CSP) header to prevent inline script execution. For educational institutions unable to patch immediately, restrict access to Clickedu via a reverse proxy configured with HSTS headers and IP-based access controls from trusted networks only, and educate users not to click on Clickedu links from unsolicited messages.