Is there a public PoC exploit available for CVE-2026-5649?

Yes, a public proof-of-concept exploit is available for CVE-2026-5649. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5649

Q: What is the CVSS score of CVE-2026-5649?

CVE-2026-5649 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19229 LOW

SQL Injection (CWE-89)

2026-04-06 VulDB

PHP SQLi Online Application System For Admission Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 11:30 euvd

EUVD-2026-19229

Analysis Generated

Apr 06, 2026 - 11:30 vuln.today

CVE Published

Apr 06, 2026 - 11:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of the file /enrollment/admsnform.php of the component Endpoint. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Online Application System for Admission 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the /enrollment/admsnform.php endpoint, enabling data exfiltration and database manipulation. The vulnerability has a CVSS score of 6.3 (medium severity) with public exploit code disclosed; exploitation requires valid user credentials but no special complexity.

Technical ContextAI

The vulnerability exists in a PHP-based enrollment form processing component (/enrollment/admsnform.php) within the Online Application System for Admission. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating insufficient input validation or parameterization of user-supplied data before SQL query construction. The affected CPE (cpe:2.3:a:code-projects:online_application_system_for_admission:*:*:*:*:*:*:*:*) indicates all versions of the 1.0 series are impacted. The vulnerability operates at the HTTP endpoint level, accepting malicious SQL syntax in form parameters that are directly concatenated into database queries without proper escaping or prepared statement usage.

RemediationAI

The primary remediation is to upgrade to a patched version released by code-projects; exact version numbers are not confirmed in available data, so administrators should consult code-projects.org and the vendor advisory for the latest security release. As an interim measure, restrict access to the /enrollment/admsnform.php endpoint using web application firewall rules or network segmentation to limit exposure to trusted users only. Code-level remediation requires implementing parameterized SQL queries (prepared statements) in the affected endpoint rather than string concatenation of user input. Input validation should enforce strict whitelisting of allowed characters and SQL syntax patterns. The VulDB advisory (https://vuldb.com/vuln/355437) and exploit documentation (https://github.com/ahmadmarz10-hub/CVEsMarz) provide technical details useful for security team review during patching.