Is there a public PoC exploit available for CVE-2026-5806?

Yes, a public proof-of-concept exploit is available for CVE-2026-5806. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5806

Q: What is the CVSS score of CVE-2026-5806?

CVE-2026-5806 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20649 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 VulDB

GHSA-fr63-2rfh-2m8c

PHP XSS Easy Blog Site Code Projects

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 08, 2026 - 22:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20649

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:15 nvd

MEDIUM 5.1

DescriptionCVE.org

A security vulnerability has been detected in code-projects Easy Blog Site 1.0. This affects an unknown function of the file /posts/update.php. The manipulation of the argument postTitle leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Easy Blog Site 1.0 allows authenticated remote attackers to inject malicious scripts via the postTitle parameter in /posts/update.php, potentially compromising user sessions and data integrity. The vulnerability requires user interaction (UI:P) and authentication (PR:L), but carries published exploit code and a moderate CVSS score of 5.1, indicating practical exploitation risk in multi-user blog environments.

Technical ContextAI

The vulnerability exists in a PHP-based blogging application (cpe:2.3:a:code-projects:easy_blog_site:*:*:*:*:*:*:*:*) where the postTitle parameter in the update.php endpoint fails to properly sanitize or encode user-supplied input before storing it in a backend data store. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw common in PHP applications that lack adequate output encoding. When the unsanitized postTitle is later displayed to other users or in administrative interfaces, the embedded JavaScript payload executes in their browsers with their privileges, enabling session hijacking, credential theft, or defacement within the blog platform.

RemediationAI

Patch availability has not been independently confirmed from vendor sources at the time of analysis. The primary remediation is to implement proper input validation and output encoding on the postTitle parameter in /posts/update.php-specifically, HTML-encode all user input before storage and ensure all displayed content is context-appropriately encoded (HTML entity encoding for display contexts). As an interim mitigation, restrict posting privileges to trusted users only, implement Web Application Firewall (WAF) rules to filter script tags and event handlers in the postTitle field, and enforce Content Security Policy (CSP) headers to limit inline script execution. For detailed technical guidance, refer to the public exploit disclosure at https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Easy%20Blog%20Site%20PHP%20postTitle%20Parameter.md and the vulnerability intelligence from https://vuldb.com/vuln/356244.