Is there a public PoC exploit available for CVE-2026-5325?

Yes, a public proof-of-concept exploit is available for CVE-2026-5325. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5325

Q: What is the CVSS score of CVE-2026-5325?

CVE-2026-5325 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18139 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-02 VulDB

GHSA-vvrm-pcwj-56vf

PHP XSS Simple Customer Relationship Management System Sourcecodester

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 07:15 euvd

EUVD-2026-18139

Analysis Generated

Apr 02, 2026 - 07:15 vuln.today

CVE Published

Apr 02, 2026 - 07:00 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was determined in SourceCodester Simple Customer Relationship Management System 1.0. This issue affects some unknown processing of the file /create-ticket.php of the component Create Ticket. This manipulation of the argument Description causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stored cross-site scripting (XSS) in SourceCodester Simple Customer Relationship Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the Description parameter in the /create-ticket.php Create Ticket component. The vulnerability requires user interaction (UI:R) to trigger payload execution and has limited impact (integrity only, no confidentiality or availability loss), but publicly available exploit code exists and the issue has been publicly disclosed.

Technical ContextAI

The vulnerability is a Stored XSS flaw (CWE-79) in a PHP-based customer relationship management application. The Create Ticket functionality in /create-ticket.php fails to properly sanitize or encode user input in the Description parameter before storing it in a backend data store and subsequently rendering it in web responses. When an authenticated user creates a ticket with malicious script content in the Description field, that payload persists in the application database. Later, when another user (or the same user) views the stored ticket data, the unescaped payload executes in their browser context, allowing attackers to steal session tokens, modify page content, or perform actions on behalf of the victim.

RemediationAI

Immediately upgrade to a patched version of SourceCodester Simple Customer Relationship Management System if available from https://www.sourcecodester.com/. If no patched version has been released, implement input validation and output encoding in the Create Ticket functionality: sanitize the Description parameter on input using a whitelist-based approach (e.g., reject or escape HTML special characters), and HTML-encode all ticket Description data when rendering in web responses using context-appropriate encoding (HTML entity encoding for display contexts). Additionally, implement Content Security Policy (CSP) headers to restrict script execution. As an interim mitigation, restrict Create Ticket access to trusted administrative users only until patches are available.