Is there a public PoC exploit available for CVE-2026-5248?

Yes, a public proof-of-concept exploit is available for CVE-2026-5248. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5248

Q: What is the CVSS score of CVE-2026-5248?

CVE-2026-5248 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17747 LOW

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-04-01 VulDB

PHP Information Disclosure N A Gougucms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 01, 2026 - 14:23 vuln.today

Public exploit code

EUVD ID Assigned

Apr 01, 2026 - 01:15 euvd

EUVD-2026-17747

Analysis Generated

Apr 01, 2026 - 01:15 vuln.today

CVE Published

Apr 01, 2026 - 00:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\app\home\controller\Login.php of the component User Registration Handler. Such manipulation of the argument level leads to dynamically-determined object attributes. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authenticated remote code execution via mass assignment in GougoCMS 4.08.18 User Registration Handler allows attackers with valid credentials to manipulate the 'level' parameter during registration, exploiting dynamically-determined object attributes to escalate privileges or modify sensitive user properties. The vulnerability affects the reg_submit function in Login.php and has publicly available exploit code; however, the vendor has not responded to early disclosure notification.

Technical ContextAI

This vulnerability exploits a mass assignment flaw (CWE-915) in PHP-based GougoCMS, where user-controllable input directly populates object attributes without proper filtering. The reg_submit function in the User Registration Handler component fails to validate or whitelist the 'level' parameter, allowing attackers to inject arbitrary attributes during object instantiation. Mass assignment vulnerabilities occur when frameworks or custom code automatically bind HTTP request parameters to object properties; in this case, the 'level' field-typically restricted to administrators-can be directly set by authenticated users during registration. The affected product is identified by CPE cpe:2.3:a:n/a:gougucms:*:*:*:*:*:*:*:* indicating the vulnerability affects GougoCMS across versions, with confirmed impact on 4.08.18.

RemediationAI

No vendor-released patch identified at time of analysis; GougoCMS vendor contact failed to respond to early disclosure. Immediate mitigation requires: (1) disable user self-registration functionality if not essential, restricting account creation to administrators only; (2) implement input validation and whitelist controls in the reg_submit function to explicitly exclude the 'level' parameter from user-controllable input, ensuring privilege assignment is admin-only; (3) apply object property filtering frameworks or ORMs that prevent mass assignment of sensitive attributes; (4) upgrade GougoCMS to a patched version when released, monitoring https://vuldb.com/vuln/354429 for vendor remediation status. Organizations running GougoCMS 4.08.18 should audit user registration logs for suspicious 'level' parameter manipulation attempts and review user role assignments for unauthorized privilege escalation.