Is there a public PoC exploit available for CVE-2026-5543?

Yes, a public proof-of-concept exploit is available for CVE-2026-5543. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5543

Q: What is the CVSS score of CVE-2026-5543?

CVE-2026-5543 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19036 LOW

SQL Injection (CWE-89)

2026-04-05 VulDB

GHSA-xhx8-v4wm-937m

PHP SQLi User Registration Login And User Management System Phpgurukul

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 04:45 euvd

EUVD-2026-19036

Analysis Generated

Apr 05, 2026 - 04:45 vuln.today

CVE Published

Apr 05, 2026 - 04:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in PHPGurukul User Registration & Login and User Management System 3.3. The affected element is an unknown function of the file /admin/yesterday-reg-users.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/yesterday-reg-users.php, potentially leading to unauthorized data access, modification, or deletion. Publicly available exploit code exists; CVSS 6.3 reflects moderate impact with low attack complexity and authenticated access requirement.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based user management application. The vulnerability exists in the /admin/yesterday-reg-users.php endpoint, where user-supplied input in the ID parameter is directly concatenated or interpolated into SQL queries without parameterized statements or proper input validation. The affected product is a widely-used open-source PHP framework for managing user registration and authentication. Attackers with valid admin credentials can craft malicious SQL payloads in the ID parameter to break out of the intended query logic and execute arbitrary SQL commands against the backend database.

RemediationAI

Immediate patching is required; contact PHPGurukul via phpgurukul.com for the latest patched version of User Registration & Login and User Management System. In the interim, implement the following controls: (1) Use parameterized SQL queries (prepared statements) with bound parameters instead of string concatenation in /admin/yesterday-reg-users.php and all related admin endpoints; (2) Apply input validation to the ID parameter to accept only expected numeric or alphanumeric formats; (3) Restrict admin panel access to a whitelist of trusted IP addresses; (4) Enforce strong authentication and multi-factor authentication for admin accounts; (5) Review database user permissions to ensure the application database account has minimal necessary privileges (no DROP or ALTER permissions if not required). Additional details and POC code are available at https://github.com/f1rstb100d/CVE/issues/4 and https://vuldb.com/vuln/355296.