Is there a public PoC exploit available for CVE-2026-5835?

Yes, a public proof-of-concept exploit is available for CVE-2026-5835. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5835

Q: What is the CVSS score of CVE-2026-5835?

CVE-2026-5835 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20834 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 VulDB

GHSA-2hg3-ppxj-cffw

PHP XSS Online Shoe Store

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 09, 2026 - 04:17 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 03:30 euvd

EUVD-2026-20834

Analysis Generated

Apr 09, 2026 - 03:30 vuln.today

CVE Published

Apr 09, 2026 - 02:45 nvd

MEDIUM 4.8

DescriptionCVE.org

A flaw has been found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_football.php. Executing a manipulation of the argument product_name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Online Shoe Store 1.0 allows authenticated attackers with high privileges to inject malicious scripts via the product_name parameter in /admin/admin_football.php, requiring user interaction to execute. The vulnerability has publicly available exploit code and a CVSS score of 2.4, reflecting the requirement for high-privilege authentication and user interaction, though the low EPSS probability and lack of CISA KEV listing suggest limited real-world exploitation despite POC availability.

Technical ContextAI

The vulnerability is a reflected or stored cross-site scripting (XSS) flaw rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected code in the PHP-based admin panel file /admin/admin_football.php fails to properly sanitize or encode the product_name parameter before rendering it in a web response. This allows an attacker with administrator credentials to inject arbitrary HTML and JavaScript that executes in the context of other users' browsers, potentially enabling session hijacking, credential theft, or defacement within the administrative interface. The CPE cpe:2.3:a:code-projects:online_shoe_store:*:*:*:*:*:*:*:* indicates the flaw affects all versions of this PHP-based e-commerce application.

RemediationAI

Implement input validation and output encoding for the product_name parameter in /admin/admin_football.php using PHP's built-in htmlspecialchars() or htmlentities() functions, or use a security library such as DOMPurify (JavaScript-side) or OWASP ESAPI. Contact code-projects.org for a patched version, or review the application source code (available on GitHub per code-projects.org) to apply fixes manually. Consider implementing a Content Security Policy (CSP) header to mitigate XSS impact. Until patched, restrict admin panel access via network firewall rules and ensure admin account credentials are protected with strong, unique passwords and multi-factor authentication.