PHP CVE-2026-5824

Q: What is the CVSS score of CVE-2026-5824?

CVE-2026-5824 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-09 cna@vuldb.com

SQLi PHP

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Apr 09, 2026 - 00:24 vuln.today

CVE Published

Apr 09, 2026 - 00:16 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /userchecklogin.php. Such manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Simple Laundry System 1.0 allows remote unauthenticated attackers to manipulate the userid parameter in /userchecklogin.php, enabling arbitrary SQL query execution with potential impact on data confidentiality, integrity, and availability. CVSS 6.9 reflects low-impact confidentiality, integrity, and availability effects without lateral propagation; exploit code is publicly available, increasing practical risk despite moderate CVSS scoring.

Technical ContextAI

The vulnerability stems from improper input validation on the userid parameter passed to /userchecklogin.php in a PHP-based web application (CWE-74: Improper Neutralization of Special Elements in Output). The user-supplied userid value is not sanitized before being incorporated into SQL queries, allowing an attacker to inject arbitrary SQL syntax. This is a classic web application vulnerability exploitable via HTTP GET or POST requests. The affected product is a standalone laundry management system written in PHP, typically deployed in shared hosting or small-business environments where input validation frameworks may be minimal.

Affected ProductsAI

code-projects Simple Laundry System version 1.0 is the confirmed affected product. This appears to be a standalone PHP application marketed via code-projects.org and tracked in vulnerability databases including VulDB (CVE reference 356271). No version range, CPE identifier, or differentiation between patches or sub-versions is provided in available data. Deployment context is typically small-to-medium business laundry management, often in shared hosting environments.

RemediationAI

No vendor-released patch version is identified at time of analysis. Immediate mitigation options include: (1) Apply parameterized SQL queries or prepared statements to the userid parameter validation in /userchecklogin.php to neutralize SQL injection; (2) Implement input validation/whitelist enforcement on userid to accept only expected alphanumeric or numeric formats; (3) If direct code patching is unavailable, restrict access to /userchecklogin.php via Web Application Firewall rules or authentication gateway until a patch is released. Contact code-projects.org for security advisory and patch availability; additional technical details are available via VulDB reference 356271 and the GitHub disclosure at lonelyuan/vunls/issues/1.