Is there a public PoC exploit available for CVE-2026-5681?

Yes, a public proof-of-concept exploit is available for CVE-2026-5681. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5681

Q: What is the CVSS score of CVE-2026-5681?

CVE-2026-5681 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19466 LOW

SQL Injection (CWE-89)

2026-04-06 VulDB

GHSA-p8gg-wgph-qc82

PHP SQLi Sanitize Or Validate This Input Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 19:30 euvd

EUVD-2026-19466

Analysis Generated

Apr 06, 2026 - 19:30 vuln.today

CVE Published

Apr 06, 2026 - 19:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument emp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode's 'sanitize or validate this input' application allows authenticated remote attackers to execute arbitrary SQL queries via the emp_id parameter in /borrowedequip.php, potentially compromising data confidentiality and integrity. The vulnerability affects version 1.0 and has publicly available exploit code; exploitation requires valid login credentials but carries low-to-moderate real-world risk given the CVSS 5.3 score and authenticated attack requirement.

Technical ContextAI

The vulnerability stems from insufficient input sanitization in a PHP-based parameter handler component, specifically in the /borrowedequip.php file where the emp_id argument is processed without proper SQL query parameterization or escaping. This is a classic CWE-89 (SQL Injection) flaw in which user-supplied input is concatenated directly into SQL queries rather than using prepared statements or parameterized queries. The affected product is identified by CPE cpe:2.3:a:itsourcecode:sanitize_or_validate_this_input:*:*:*:*:*:*:*:*, suggesting the vulnerability affects all versions of this input validation/sanitization library or application. The PHP-based backend likely uses unparameterized query construction, allowing attackers to inject SQL syntax through the emp_id parameter to manipulate query logic.

RemediationAI

Immediate action should focus on upgrading to a patched version released by itsourcecode; consult https://itsourcecode.com/ for the latest available release. As an interim mitigation pending vendor updates, implement parameterized SQL queries (prepared statements) with bound parameters for all database operations, enforce input validation on the emp_id parameter using whitelist-based validation for expected identifier formats, and restrict /borrowedequip.php access to authorized users only via web application firewall rules or network segmentation. Additional hardening includes implementing least-privilege database account permissions and enabling SQL query logging to detect injection attempts. Detailed vulnerability information is available at https://vuldb.com/vuln/355508.