Is there a public PoC exploit available for CVE-2026-5847?

Yes, a public proof-of-concept exploit is available for CVE-2026-5847. Prioritise patching immediately. EPSS: 0.0%.

Movie Ticketing System CVE-2026-5847

Q: What is the CVSS score of CVE-2026-5847?

CVE-2026-5847 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20856 LOW

Information Exposure (CWE-200)

2026-04-09 VulDB

GHSA-w2mf-pmr4-jj6w

Information Disclosure Movie Ticketing System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 05:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 05:15 euvd

EUVD-2026-20856

Analysis Generated

Apr 09, 2026 - 05:15 vuln.today

CVE Published

Apr 09, 2026 - 05:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in code-projects Movie Ticketing System 1.0. Impacted is an unknown function of the file /db/moviedb.sql of the component SQL Database Backup File Handler. Such manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Code-Projects Movie Ticketing System 1.0 exposes sensitive database information through an unprotected SQL backup file at /db/moviedb.sql, allowing remote unauthenticated attackers to download and read the entire database via simple HTTP request. The vulnerability requires user interaction (UI:P per CVSS4.0) and has a publicly available exploit demonstrating the disclosure technique, though the very low CVSS score of 2.1 reflects limited confidentiality impact in typical deployments.

Technical ContextAI

The SQL Database Backup File Handler component fails to implement access controls on backup database files, a manifestation of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected product (CPE: cpe:2.3:a:code-projects:movie_ticketing_system:*:*:*:*:*:*:*:*) uses PHP and stores an unencrypted, world-accessible SQL dump at a predictable web-accessible path. This is a classic information disclosure vulnerability where database credentials, user data, and application schema are exposed without authentication or authorization checks. The remote network attack vector (AV:N) combined with low attack complexity (AC:L) means any network-connected attacker can retrieve the file, though the CVSS:4.0 vector's UI:P modifier indicates some user action (e.g., clicking a link, social engineering) may facilitate exploitation.

RemediationAI

Immediately remove or relocate the /db/moviedb.sql file from any web-accessible directory. If database backups must be stored on the server, place them outside the web root (e.g., /var/backups/db/ instead of /var/www/html/db/) and restrict file permissions to the database user only (chmod 600). Implement web server configuration rules (e.g., Apache .htaccess or nginx location block) to deny direct access to all .sql files: deny access to files matching *.sql in any web path. For immediate mitigation, apply a deny rule in your web server configuration before upgrading. Contact Code-Projects for a patched version; verify the release notes confirm removal of the backup file from the distribution package. If this is a legacy system no longer supported, consider migration to a maintained ticketing platform with proper security controls.