Is there a public PoC exploit available for CVE-2026-5157?

Yes, a public proof-of-concept exploit is available for CVE-2026-5157. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5157

Q: What is the CVSS score of CVE-2026-5157?

CVE-2026-5157 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17253 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 VulDB

PHP XSS Online Food Ordering System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 23:45 euvd

EUVD-2026-17253

Analysis Generated

Mar 30, 2026 - 23:45 vuln.today

CVE Published

Mar 30, 2026 - 23:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected is an unknown function of the file /form/order.php of the component Order Module. Such manipulation of the argument cust_id leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

Reflected cross-site scripting (XSS) in code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the cust_id parameter in /form/order.php, exploitable through user interaction (UI required). Publicly available exploit code exists; the vulnerability carries CVSS 4.3 (low severity) but poses reputational and user session hijacking risks typical of XSS attacks in e-commerce contexts.

Technical ContextAI

The vulnerability is a reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based e-commerce application. The Order Module's order.php endpoint fails to sanitize or encode the cust_id parameter before rendering it in an HTTP response, allowing attackers to inject arbitrary JavaScript code. The vulnerability affects code-projects Online Food Ordering System via the CPE cpe:2.3:a:code-projects:online_food_ordering_system:*:*:*:*:*:*:*:*, indicating all versions of this product are potentially vulnerable. The reflective nature requires the victim to follow a malicious link, but the low attack complexity and lack of authentication requirements make it straightforward to exploit in practice.

RemediationAI

Immediate remediation requires input validation and output encoding: all user-supplied input (especially cust_id) must be sanitized using parameterized queries or prepared statements for any database operations, and HTML-encoded or JavaScript-escaped before insertion into the page response. For PHP applications, use htmlspecialchars() or a templating engine with auto-escaping to prevent reflection of unsanitized parameters. Code-projects maintainers should release a patched version of Online Food Ordering System with these fixes applied to /form/order.php. Pending patch availability, temporary mitigation includes implementing a Web Application Firewall (WAF) rule to block requests with suspicious characters in the cust_id parameter or disabling the vulnerable endpoint if not essential to operations. Reference the VulDB record (https://vuldb.com/vuln/354189) and the public exploit code at https://gist.github.com/HxH404/f7f1502ffc9f2aacc936a6e8f290b6a5 for testing and validation of fixes.