What is the CVSS score of CVE-2026-5847?

CVE-2026-5847 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-5847?

Yes, a public proof-of-concept exploit is available for CVE-2026-5847. Prioritise patching immediately. EPSS: 0.0%.

Movie Ticketing System CVE-2026-5847

EUVD-2026-20856 LOW

Information Exposure (CWE-200)

2026-04-09 VulDB

GHSA-w2mf-pmr4-jj6w

Information Disclosure Movie Ticketing System Code Projects

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	While the CVSS score of 2.1 is extremely low, this assessment significantly understates the real-world risk. The publicly available exploit code and low attack complexity (AC:L, AT:N) mean exploitation is trivial and automatable. The UI:P modifier in CVSS4.0 is a significant limiting factor - it suggests the attack requires end-user interaction, which may be a misclassification given that /db/moviedb.sql is likely directly accessible via HTTP GET without user involvement. The core issue is that database backup files should never be web-accessible; even a low-CVSS disclosure in a ticketing system exposes customer payment data, personal information, and credentials. For deployments handling real transaction data, the actual impact is HIGH despite the CVSS rating. SSVC analysis would flag this as exploitation:PoC-available, automatable:true, technical-impact:total (full database exposure), elevating priority significantly above the CVSS score. This is a high-priority remediation despite low CVSS, as it requires no exploitation sophistication and has immediate real-world impact.
Exploit ScenarioDerived	An attacker discovers the /db/moviedb.sql file is publicly accessible via HTTP GET request to http://vulnerable-ticketing-system.com/db/moviedb.sql. The file can be downloaded in full without authentication, exposing all database tables including user accounts, payment information, and application configuration secrets. Public exploit code (available on GitHub per references) automates this discovery and download; an attacker can weaponize this to extract customer email addresses, transaction histories, and stored credentials within minutes. Social engineering or phishing could trick users into clicking a link that triggers a browser download of the file, satisfying the UI:P requirement, or the file may be directly crawled by automated vulnerability scanners.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Code-Projects Movie Ticketing System 1.0 exposes sensitive database information through an unprotected SQL backup file at /db/moviedb.sql, allowing remote unauthenticated attackers to download and read the entire database via simple HTTP request. The vulnerability requires user interaction (UI:P per CVSS4.0) and has a publicly available exploit demonstrating the disclosure technique, though the very low CVSS score of 2.1 reflects limited confidentiality impact in typical deployments.

RemediationAI

Immediately remove or relocate the /db/moviedb.sql file from any web-accessible directory. If database backups must be stored on the server, place them outside the web root (e.g., /var/backups/db/ instead of /var/www/html/db/) and restrict file permissions to the database user only (chmod 600). Implement web server configuration rules (e.g., Apache .htaccess or nginx location block) to deny direct access to all .sql files: deny access to files matching *.sql in any web path. For immediate mitigation, apply a deny rule in your web server configuration before upgrading. Contact Code-Projects for a patched version; verify the release notes confirm removal of the backup file from the distribution package. If this is a legacy system no longer supported, consider migration to a maintained ticketing platform with proper security controls.

Affected VersionsENISA

Movie Ticketing System 1.0

Affected Packages

euvd movie_ticketing_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The SQL Database Backup File Handler component fails to implement access controls on backup database files, a manifestation of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected product (CPE: cpe:2.3:a:code-projects:movie_ticketing_system:*:*:*:*:*:*:*:*) uses PHP and stores an unencrypted, world-accessible SQL dump at a predictable web-accessible path. This is a classic information disclosure vulnerability where database credentials, user data, and application schema are exposed without authentication or authorization checks. The remote network attack vector (AV:N) combined with low attack complexity (AC:L) means any network-connected attacker can retrieve the file, though the CVSS:4.0 vector's UI:P modifier indicates some user action (e.g., clicking a link, social engineering) may facilitate exploitation.

Know when Movie Ticketing System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 05:16 vuln.today

Public exploit code

CVE Published

Apr 09, 2026 - 05:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in code-projects Movie Ticketing System 1.0. Impacted is an unknown function of the file /db/moviedb.sql of the component SQL Database Backup File Handler. Such manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact· derived

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +10

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.