Is there a public PoC exploit available for CVE-2026-5805?

Yes, a public proof-of-concept exploit is available for CVE-2026-5805. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5805

Q: What is the CVSS score of CVE-2026-5805?

CVE-2026-5805 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20647 MEDIUM

SQL Injection (CWE-89)

2026-04-08 VulDB

GHSA-48h8-qxm4-xrp8

PHP SQLi Easy Blog Site Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 08, 2026 - 21:26 vuln.today

Public exploit code

EUVD ID Assigned

Apr 08, 2026 - 20:46 euvd

EUVD-2026-20647

Analysis Generated

Apr 08, 2026 - 20:46 vuln.today

CVE Published

Apr 08, 2026 - 20:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in code-projects Easy Blog Site up to 1.0. The impacted element is an unknown function of the file /users/contact_us.php. Executing a manipulation of the argument Name can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Remote code execution via SQL injection in code-projects Easy Blog Site up to version 1.0 allows unauthenticated attackers to manipulate the Name parameter in /users/contact_us.php, leading to arbitrary SQL command execution. The vulnerability has a CVSS score of 6.9 with network-based attack vector and low complexity, and publicly available exploit code exists, making this an immediate concern for affected deployments.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based blogging application. The /users/contact_us.php file fails to properly sanitize user input from the Name parameter before incorporating it into SQL queries. Attackers can inject arbitrary SQL syntax through this parameter to manipulate database operations, extract sensitive data, or modify database contents. The affected product is code-projects Easy Blog Site (CPE: cpe:2.3:a:code-projects:easy_blog_site:*:*:*:*:*:*:*:*), with vulnerability confirmed in version 1.0 and potentially earlier versions. The attack vector is network-based with no authentication required (PR:N per CVSS 4.0 vector), allowing any remote attacker to craft malicious HTTP requests targeting the contact form.

RemediationAI

Immediately upgrade code-projects Easy Blog Site to a patched version released after the disclosure. Vendor advisories and patch availability details should be obtained directly from https://code-projects.org/ or the VulDB entry at https://vuldb.com/vuln/356243. As an interim mitigation while awaiting patches, disable or restrict access to the /users/contact_us.php file at the web server level, implement strict input validation and parameterized queries for all SQL operations, and apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Name parameter. Input sanitization using PHP prepared statements or parameterized queries is essential to prevent SQL injection attacks.