Is there a public PoC exploit available for CVE-2026-5537?

Yes, a public proof-of-concept exploit is available for CVE-2026-5537. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5537

Q: What is the CVSS score of CVE-2026-5537?

CVE-2026-5537 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19023 LOW

SQL Injection (CWE-89)

2026-04-05 VulDB

GHSA-8q6m-q7p9-67pr

PHP SQLi Coursesel

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 04:00 euvd

EUVD-2026-19023

Analysis Generated

Apr 05, 2026 - 04:00 vuln.today

CVE Published

Apr 05, 2026 - 03:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the file Apps/Index/Controller/IndexController.class.php of the component HTTP GET Parameter Handler. The manipulation of the argument seid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in halex CourseSEL up to version 1.1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the seid parameter in the HTTP GET request handler, potentially leading to unauthorized data access, modification, and denial of service. The vulnerability affects the check_sel function in IndexController.class.php and has publicly available exploit code; the vendor has not responded to early disclosure notifications.

Technical ContextAI

The vulnerability exists in a PHP-based HTTP GET parameter handler within halex CourseSEL, a course management application. The root cause is insufficient input validation on the seid parameter passed to the check_sel function in Apps/Index/Controller/IndexController.class.php, allowing direct injection of SQL commands into database queries (CWE-89: SQL Injection). The attack exploits the application's failure to use parameterized queries or proper input sanitization, enabling attackers to manipulate SQL syntax and bypass intended query logic. The affected product is identified by CPE cpe:2.3:a:halex:coursesel:*:*:*:*:*:*:*:* covering all versions up to and including 1.1.0.

RemediationAI

Immediate remediation requires upgrading to a patched version of halex CourseSEL; however, no vendor-released patched version is confirmed at this time due to vendor non-responsiveness to disclosure. Organizations should contact halex directly to request a security update or assess alternative course management solutions if no patch becomes available. As an interim mitigation, implement web application firewall (WAF) rules to detect and block SQL injection patterns in GET parameters (particularly the seid parameter), restrict access to the IndexController endpoint to trusted network segments, enforce principle of least privilege for database accounts used by the application, and conduct immediate audit of access logs for evidence of exploitation attempts. For defense-in-depth, implement parameterized query frameworks and input validation at the application level if source code access is available.