Is there a public PoC exploit available for CVE-2026-5839?

Yes, a public proof-of-concept exploit is available for CVE-2026-5839. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5839

Q: What is the CVSS score of CVE-2026-5839?

CVE-2026-5839 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20848 LOW

SQL Injection (CWE-89)

2026-04-09 VulDB

GHSA-x5wf-x97f-9f8v

PHP SQLi News Portal Project Phpgurukul

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 09, 2026 - 05:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 04:30 euvd

EUVD-2026-20848

Analysis Generated

Apr 09, 2026 - 04:30 vuln.today

CVE Published

Apr 09, 2026 - 03:45 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was identified in PHPGurukul News Portal Project 4.1. This issue affects some unknown processing of the file /admin/add-subcategory.php. Such manipulation of the argument sucatdescription leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in PHPGurukul News Portal Project 4.1 allows authenticated remote attackers with high privileges to manipulate the sucatdescription parameter in /admin/add-subcategory.php, enabling unauthorized database query execution with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists and the CVSS vector indicates proof-of-concept availability (E:P), though this is a low-severity vulnerability (CVSS 4.7) constrained by high administrative privilege requirements.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in a PHP-based content management system. The PHPGurukul News Portal Project is a web application framework built in PHP for managing news content. The specific vulnerable endpoint /admin/add-subcategory.php fails to properly sanitize or parameterize the sucatdescription input parameter before incorporating it into SQL queries. This allows an attacker with administrative credentials to inject arbitrary SQL commands that execute within the database context of the application. The CPE cpe:2.3:a:phpgurukul:news_portal_project:*:*:*:*:*:*:*:* indicates all versions of the product are potentially affected, though version 4.1 is explicitly mentioned.

RemediationAI

No vendor-released patch identified at time of analysis. Administrators should implement the following mitigations: (1) Apply input validation and output encoding to the sucatdescription parameter in /admin/add-subcategory.php, converting all user input through parameterized queries or prepared statements to prevent SQL injection; (2) Restrict administrative access to trusted users only and enforce strong authentication controls; (3) Review server logs for suspicious database activity or SQL syntax errors that may indicate exploitation attempts; (4) Consider upgrading to a maintained fork or alternative news portal system if the PHPGurukul project is no longer receiving security updates. For detailed vulnerability information and community discussions, see https://vuldb.com/vuln/356295 and exploit analysis at https://github.com/f1rstb100d/CVE/issues/28.