PHP CVE-2026-5579

Q: What is the CVSS score of CVE-2026-5579?

CVE-2026-5579 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19107 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-05 cna@vuldb.com

GHSA-q6hf-ggqp-fj8w

SQLi PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 05, 2026 - 16:22 euvd

EUVD-2026-19107

Analysis Generated

Apr 05, 2026 - 16:22 vuln.today

CVE Published

Apr 05, 2026 - 16:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in CodeAstro Online Classroom 1.0. This issue affects some unknown processing of the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 of the component Parameter Handler. Executing a manipulation of the argument fname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in CodeAstro Online Classroom 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the fname parameter in the /OnlineClassroom/updatedetailsfromfaculty.php endpoint. The vulnerability has been publicly disclosed with exploit code available, presenting moderate real-world risk due to required authentication (PR:L) but low technical impact (VC:L, VI:L, VA:L) per CVSS 4.0 scoring.

Technical ContextAI

The vulnerability exists in a PHP parameter handler component that processes user input without proper sanitization or parameterized query protection. The affected endpoint updatedetailsfromfaculty.php accepts the myfid query parameter and processes the fname argument in database operations, likely constructing SQL queries through string concatenation rather than using prepared statements. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection') indicates the root cause is insufficient input validation before passing user-controlled data to SQL query execution. CodeAstro Online Classroom is a PHP-based web application for educational institution management, and the affected component handles faculty data updates without proper query parameterization.

RemediationAI

Apply the latest security patch or upgrade to a patched version of CodeAstro Online Classroom beyond 1.0. If a specific patched version is not yet available, implement immediate input validation and use parameterized queries (prepared statements) in the updatedetailsfromfaculty.php file, particularly for the fname and myfid parameters. Ensure all user input is escaped or validated against a whitelist before inclusion in SQL queries. Apply principle of least privilege to database user accounts accessing this component. Monitor the CodeAstro project repository (https://github.com/zgr0508/cve/issues/2) and vendor advisory channels for patch availability. In the interim, restrict access to the /OnlineClassroom/updatedetailsfromfaculty.php endpoint to trusted network ranges or implement Web Application Firewall rules to block SQL injection payloads.