Is there a public PoC exploit available for CVE-2026-5634?

Yes, a public proof-of-concept exploit is available for CVE-2026-5634. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5634

Q: What is the CVSS score of CVE-2026-5634?

CVE-2026-5634 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19200 MEDIUM

SQL Injection (CWE-89)

2026-04-06 VulDB

GHSA-xhjx-m35j-wjqw

PHP SQLi Car Rental Project Projectworlds

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 08:15 euvd

EUVD-2026-19200

Analysis Generated

Apr 06, 2026 - 08:15 vuln.today

CVE Published

Apr 06, 2026 - 07:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in projectworlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /book_car.php of the component Parameter Handler. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in projectworlds Car Rental Project 1.0 allows remote attackers to execute arbitrary SQL queries via the fname parameter in /book_car.php, enabling unauthenticated database manipulation with potential confidentiality and integrity impact. The vulnerability has publicly available exploit code and a moderate CVSS score of 6.9, indicating practical exploitability despite low attack complexity.

Technical ContextAI

The vulnerability exists in the Parameter Handler component of the Car Rental Project, a PHP-based web application. The root cause is improper input validation and parameterization in the SQL query construction for the /book_car.php endpoint. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-supplied input from the fname parameter is incorporated directly into SQL statements without adequate escaping, type casting, or prepared statement use. The affected product spans the Car Rental Project codebase (CPE: cpe:2.3:a:projectworlds:car_rental_project:*:*:*:*:*:*:*:*), suggesting all versions prior to any vendor-issued patch are vulnerable.

RemediationAI

Immediate remediation requires upgrading to a patched version of projectworlds Car Rental Project if available from the vendor; however, no vendor-released patch version is independently confirmed in current advisory data. As an interim mitigation, apply input validation and parameterized queries (prepared statements) to the /book_car.php file, specifically sanitizing the fname parameter before use in any SQL statement. Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the fname parameter. Consult VulDB submission https://vuldb.com/submit/785863 and monitor the vendor repository for official patch releases. Apply principle of least privilege to database user accounts to limit the scope of data accessible via SQL injection exploitation.