PHP CVE-2026-5648

Q: What is the CVSS score of CVE-2026-5648?

CVE-2026-5648 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19227 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-06 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 06, 2026 - 11:22 euvd

EUVD-2026-19227

Analysis Generated

Apr 06, 2026 - 11:22 vuln.today

CVE Published

Apr 06, 2026 - 11:17 nvd

MEDIUM 6.9

DescriptionCVE.org

A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the firstName parameter in /userfinishregister.php, enabling data exfiltration and manipulation. The vulnerability has publicly available exploit code and a published CVSS 6.9 score reflecting moderate confidentiality and integrity impact.

Technical ContextAI

The vulnerability exists in the PHP-based Simple Laundry System parameter handler, specifically in the /userfinishregister.php endpoint where user-supplied firstName input is processed without proper sanitization or parameterized query preparation. This classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output Command) occurs when untrusted input is directly concatenated into SQL queries. The remote network attack vector (AV:N) with low attack complexity (AC:L) and no privilege requirements (PR:N) indicates the vulnerability is trivially exploitable via HTTP requests. The CVSS 4.0 vector shows low confidentiality (VC:L), integrity (VI:L), and availability (VA:L) impact without scope change, suggesting the attacker gains access within the affected application's authorization context.

RemediationAI

Immediate remediation requires updating to a patched version of Simple Laundry System if one is available from code-projects; however, no specific patched version number is confirmed in the provided data. In the interim, implement parameterized prepared statements for all SQL queries in /userfinishregister.php and apply input validation/sanitization to the firstName parameter (whitelist alphanumeric characters, reject SQL metacharacters). Additionally, restrict database account privileges to the minimum required for application functionality, and deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the firstName parameter. Consult the vendor advisory at https://code-projects.org/ and the detailed vulnerability report at https://vuldb.com/vuln/355436 for vendor-specific guidance.