Which versions of PHP are affected by CVE-2026-5034?

Organizations using A flaw should be aware of notable risk from CVE-2026-5034, a SQL injection vulnerability rated CVSS 6.9.

Is there a public PoC exploit available for CVE-2026-5034?

Yes, a public proof-of-concept exploit is available for CVE-2026-5034. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5034?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-5034

Q: What is the CVSS score of CVE-2026-5034?

CVE-2026-5034 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16977 MEDIUM

SQL Injection (CWE-89)

2026-03-29 VulDB

GHSA-vr29-pvvw-gw33

PHP SQLi Accounting System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 18:59 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 06:15 euvd

EUVD-2026-16977

Analysis Generated

Mar 29, 2026 - 06:15 vuln.today

CVE Published

Mar 29, 2026 - 06:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of the file /edit_costumer.php of the component Parameter Handler. This manipulation of the argument cos_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cos_id parameter in /edit_costumer.php. The vulnerability has a CVSS 4.0 score of 6.9 with low impact to confidentiality, integrity, and availability. Publicly available exploit code exists, elevating real-world risk despite moderate CVSS severity.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based web application. The Parameter Handler component in code-projects Accounting System fails to sanitize or parameterize the cos_id parameter before incorporating it into SQL queries executed against the backend database. The attack occurs through the /edit_costumer.php endpoint, which processes customer-related data. An attacker can craft malicious SQL syntax within the cos_id parameter to break out of the intended query context and execute arbitrary database commands. The CPE cpe:2.3:a:code-projects:accounting_system:*:*:*:*:*:*:*:* indicates all versions of the Accounting System application are affected.

RemediationAI

Apply an immediate patch or upgrade from the vendor at https://code-projects.org/. If a patched version is not yet available, implement input validation and parameterized prepared statements (prepared queries) for all database interactions, especially in /edit_costumer.php. Use allowlist validation on the cos_id parameter to accept only expected numeric or alphanumeric values. Consider temporarily disabling or restricting access to the customer edit functionality via web application firewall rules or network controls. A secondary control is to apply least-privilege database user permissions so that the application database account cannot perform administrative operations. Consult VulDB advisory at https://vuldb.com/vuln/353960 for vendor-specific remediation guidance.