Is there a public PoC exploit available for CVE-2026-5650?

Yes, a public proof-of-concept exploit is available for CVE-2026-5650. Prioritise patching immediately. EPSS: 0.0%.

Online Application System For Admission CVE-2026-5650

Q: What is the CVSS score of CVE-2026-5650?

CVE-2026-5650 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19233 MEDIUM

Insecure Storage of Sensitive Information (CWE-922)

2026-04-06 VulDB

GHSA-42cx-f4wf-mcfc

Information Disclosure Online Application System For Admission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 12:00 euvd

EUVD-2026-19233

Analysis Generated

Apr 06, 2026 - 12:00 vuln.today

CVE Published

Apr 06, 2026 - 11:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

Code-Projects Online Application System for Admission 1.0 stores sensitive information insecurely in the /enrollment/database/oas.sql file, allowing remote unauthenticated attackers to disclose confidential data. The vulnerability has publicly available exploit code and is rated CVSS 5.3 with an EPSS percentile indicating moderate exploitation probability. Attackers can access the database backup file remotely without authentication or user interaction, leading to information disclosure.

Technical ContextAI

The Online Application System for Admission (OAS) application exposes a database backup file (oas.sql) through the web-accessible /enrollment/database/ directory without proper access controls. This represents a CWE-922 (Insecure Storage of Sensitive Information) vulnerability where database backup files containing sensitive admission data are stored in a location accessible over the network. The root cause is inadequate file system permissions and lack of directory listing restrictions, allowing direct retrieval of SQL database dumps that typically contain plaintext passwords, personal information, and other sensitive admission records. The backup file being world-readable due to misconfiguration or intentional exposure creates a direct information disclosure channel.

RemediationAI

The primary remediation is to immediately remove or relocate the oas.sql database backup file from the web-accessible /enrollment/database/ directory to a location outside the web root. Additionally, implement strict access controls and disable directory listing on all database directories using web server configuration (e.g., Apache .htaccess or Nginx directives). If a backup must remain accessible, restrict access via authentication and use a dedicated backup management system rather than exposing SQL dumps directly. Upgrade to a patched version when available from Code-Projects (vendor-released patch status not confirmed at time of analysis); in the interim, apply these access control mitigations immediately. Audit server logs to determine if the oas.sql file has been accessed or downloaded. Review the database for unauthorized access and reset all credentials exposed in any backup files.