Is there a public PoC exploit available for CVE-2026-5196?

Yes, a public proof-of-concept exploit is available for CVE-2026-5196. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5196

Q: What is the CVSS score of CVE-2026-5196?

CVE-2026-5196 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17351 LOW

SQL Injection (CWE-89)

2026-03-31 VulDB

GHSA-wjmf-99rj-jgch

PHP SQLi Student Membership System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 09:15 euvd

EUVD-2026-17351

Analysis Generated

Mar 31, 2026 - 09:15 vuln.today

CVE Published

Mar 31, 2026 - 09:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Student Membership System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /delete_member.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists, and the vulnerability has been disclosed; however, active exploitation has not been confirmed by CISA. The attack requires valid authentication credentials but can be initiated over the network with minimal complexity.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based student membership management application. The /delete_member.php endpoint fails to properly sanitize or parameterize user-supplied input in the ID parameter before incorporating it into database queries. The affected product (cpe:2.3:a:code-projects:student_membership_system:*:*:*:*:*:*:*:*) is a web application likely built using PHP with direct SQL query construction rather than prepared statements or ORM frameworks. SQL injection at this layer allows attackers to manipulate query logic, potentially extracting, modifying, or deleting sensitive membership data.

RemediationAI

Upgrade to a patched version of code-projects Student Membership System if available from code-projects.org. If no patched version has been released, immediately implement input validation and parameterized queries (prepared statements) in the /delete_member.php file to sanitize the ID parameter before use in SQL queries. Apply principle of least privilege to database user accounts so that the PHP application connects with minimal required permissions. Additionally, implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the delete_member.php endpoint, and enforce strong authentication controls to limit access to this administrative function. For immediate mitigation pending a full patch, restrict access to the /delete_member.php endpoint to trusted IP addresses or require additional authorization steps for member deletion operations.