Is there a public PoC exploit available for CVE-2026-5578?

Yes, a public proof-of-concept exploit is available for CVE-2026-5578. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5578

Q: What is the CVSS score of CVE-2026-5578?

CVE-2026-5578 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19105 LOW

SQL Injection (CWE-89)

2026-04-05 VulDB

GHSA-cq7w-jw8v-vp8v

PHP SQLi Online Classroom Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 16:00 euvd

EUVD-2026-19105

Analysis Generated

Apr 05, 2026 - 16:00 vuln.today

CVE Published

Apr 05, 2026 - 15:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /OnlineClassroom/addassessment.php of the component Parameter Handler. Performing a manipulation of the argument deleteid results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in CodeAstro Online Classroom 1.0 via the deleteid parameter in /OnlineClassroom/addassessment.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. Public exploit code is available, increasing practical risk despite the moderate CVSS 5.3 score. The vulnerability requires valid authentication (PR:L) but uses a common attack vector (AV:N, AC:L) typical of parameter validation flaws in PHP web applications.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based Learning Management System. The vulnerable code path is the addassessment.php file's Parameter Handler component, which fails to properly sanitize or parameterize the deleteid input parameter before incorporating it into database queries. The CPE string cpe:2.3:a:codeastro:online_classroom:*:*:*:*:*:*:*:* indicates all versions of CodeAstro Online Classroom are potentially affected. The attack surface is the HTTP parameter manipulation of deleteid, likely intended as a record identifier for deletion operations. Lack of input validation or prepared statement usage allows an attacker to inject arbitrary SQL commands into the query execution context.

RemediationAI

Apply a vendor-released security patch immediately by updating CodeAstro Online Classroom to a patched version once available from https://codeastro.com/. In the interim, implement database access controls and input validation by replacing direct SQL concatenation with prepared statements or parameterized queries in the addassessment.php file's deleteid parameter handler. Additionally, restrict access to the addassessment.php endpoint to authenticated users with appropriate role-based permissions, and monitor database query logs for suspicious SQL patterns or injection attempts. Contact CodeAstro support for confirmed patch availability and upgrade instructions.