Is there a public PoC exploit available for CVE-2026-5650?

Yes, a public proof-of-concept exploit is available for CVE-2026-5650. Prioritise patching immediately. EPSS: 0.0%.

Online Application System For Admission CVE-2026-5650

Q: What is the CVSS score of CVE-2026-5650?

CVE-2026-5650 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19233 MEDIUM

Insecure Storage of Sensitive Information (CWE-922)

2026-04-06 VulDB

GHSA-42cx-f4wf-mcfc

Information Disclosure Online Application System For Admission

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 12:00 euvd

EUVD-2026-19233

Analysis Generated

Apr 06, 2026 - 12:00 vuln.today

CVE Published

Apr 06, 2026 - 11:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

Code-Projects Online Application System for Admission 1.0 stores sensitive information insecurely in the /enrollment/database/oas.sql file, allowing remote unauthenticated attackers to disclose confidential data. The vulnerability has publicly available exploit code and is rated CVSS 5.3 with an EPSS percentile indicating moderate exploitation probability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	Despite the moderate CVSS score of 5.3, this vulnerability presents real exploitation risk due to multiple confirming signals: the attack vector is network-based requiring no authentication (AV:N/PR:N/UI:N per CVSS vector), exploit code is publicly available on GitHub, and the technical impact is direct information disclosure of sensitive admission data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker discovers the web-accessible /enrollment/database/oas.sql file through directory enumeration or simple URL guessing (e.g., visiting http://target/enrollment/database/oas.sql). The attacker downloads the unencrypted SQL backup file without authentication and extracts sensitive information including applicant personal data, admission decisions, and database credentials. …
Remediation	The primary remediation is to immediately remove or relocate the oas.sql database backup file from the web-accessible /enrollment/database/ directory to a location outside the web root. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-5650 vulnerability details – vuln.today

Back