Is there a public PoC exploit available for CVE-2026-5814?

Yes, a public proof-of-concept exploit is available for CVE-2026-5814. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5814

Q: What is the CVSS score of CVE-2026-5814?

CVE-2026-5814 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20807 MEDIUM

SQL Injection (CWE-89)

2026-04-08 VulDB

GHSA-97cp-2796-qq3g

PHP SQLi Online Course Registration Phpgurukul

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 09, 2026 - 00:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 08, 2026 - 23:31 euvd

EUVD-2026-20807

Analysis Generated

Apr 08, 2026 - 23:31 vuln.today

CVE Published

Apr 08, 2026 - 23:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in PHPGurukul Online Course Registration 3.1. This issue affects some unknown processing of the file /admin/check_availability.php. The manipulation of the argument regno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in PHPGurukul Online Course Registration 3.1 allows remote unauthenticated attackers to manipulate the regno parameter in /admin/check_availability.php, enabling arbitrary database queries with potential for data exfiltration and modification. The vulnerability has a publicly available exploit and CVSS 6.9 score indicating moderate severity with confirmed data confidentiality and integrity impact.

Technical ContextAI

The vulnerability exists in the PHP-based PHPGurukul Online Course Registration application, specifically in the administrative endpoint /admin/check_availability.php. The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating insufficient input validation or parameterized query usage on the regno parameter. The application fails to properly sanitize or escape user-supplied input before embedding it into SQL queries, allowing attackers to inject arbitrary SQL syntax. This is a classic server-side vulnerability in a PHP web application where user input flows directly into database commands without proper protection mechanisms such as prepared statements or input validation.

RemediationAI

Immediate action is required: upgrade PHPGurukul Online Course Registration to a patched version released by the vendor after this vulnerability disclosure. Consult https://phpgurukul.com/ for the latest available version and security advisories. If immediate patching is not possible, implement network-level access controls to restrict access to /admin/ endpoints to trusted IP ranges only, disable or remove the /admin/check_availability.php file if not actively used, and apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the regno parameter. Additionally, review database user permissions to ensure the application database account has minimal necessary privileges to limit damage from successful injection. Enable comprehensive logging and monitoring of database queries for anomalous SQL patterns.