Which versions of PHP are affected by CVE-2026-5035?

Organizations using A vulnerability should be aware of notable risk from CVE-2026-5035, a SQL injection vulnerability rated CVSS 6.9.

Is there a public PoC exploit available for CVE-2026-5035?

Yes, a public proof-of-concept exploit is available for CVE-2026-5035. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5035?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-5035

Q: What is the CVSS score of CVE-2026-5035?

CVE-2026-5035 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16979 MEDIUM

SQL Injection (CWE-89)

2026-03-29 VulDB

GHSA-5vxj-h27x-942q

PHP SQLi Accounting System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 18:59 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 07:15 euvd

EUVD-2026-16979

Analysis Generated

Mar 29, 2026 - 07:15 vuln.today

CVE Published

Mar 29, 2026 - 07:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_work.php of the component Parameter Handler. Such manipulation of the argument en_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the en_id parameter in /view_work.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code is available, increasing practical exploitation risk despite the moderate CVSS score of 6.9.

Technical ContextAI

The vulnerability exists in the Parameter Handler component of a PHP-based accounting application. The /view_work.php file fails to properly sanitize or parameterize the en_id input parameter before using it in SQL queries, enabling classic SQL injection (CWE-89). The affected product is code-projects Accounting System across all versions (CPE: cpe:2.3:a:code-projects:accounting_system:*:*:*:*:*:*:*:*), indicating the vulnerability may be present from the initial release. The use of dynamic SQL concatenation with user-controlled input without prepared statements or input validation is the root cause.

RemediationAI

Immediately upgrade code-projects Accounting System to a patched version when available from the vendor at https://code-projects.org/. If no patched version is currently available, implement input validation and parameterized queries (prepared statements) for the en_id parameter in /view_work.php to prevent SQL injection. Apply principle of least privilege to database accounts used by the application, restrict access to the /view_work.php endpoint via Web Application Firewall (WAF) rules or network segmentation, and monitor database query logs for suspicious SQL patterns. Consult the vendor advisory and VulDB references (https://vuldb.com/vuln/353961/cti) for additional security guidance.