What is the CVSS score of CVE-2026-6000?

CVE-2026-6000 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-6000?

Yes, a public proof-of-concept exploit is available for CVE-2026-6000. Prioritise patching immediately. EPSS: 0.0%.

Online Library Management System CVE-2026-6000

EUVD-2026-21282 LOW

Information Exposure (CWE-200)

2026-04-10 VulDB

Information Disclosure Online Library Management System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

View

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	While the CVSS score of 4.3 appears low, multiple factors warrant closer examination. The attack vector is network-based and unauthenticated (PR:N), with no special privileges or system configuration required beyond standard HTTP access. However, the attack complexity is low and requires user interaction (UI:R per CVSS vector), which is a significant practical limitation. The confidentiality impact is low (C:L) with no integrity or availability impact (I:N, A:N). Exploitation probability is moderate (E:P) with publicly available proof-of-concept code, but the lack of CISA KEV (Known Exploited Vulnerabilities) listing and reliance on user interaction suggest limited automated exploitation potential. The CVSS Rating of 4.3 accurately reflects a low-severity issue with meaningful real-world constraints. Organizations should assess whether the /sql/library.sql file contains high-value sensitive information in their specific deployments; if so, priority should increase. SSVC analysis indicates low exploitability and limited technical impact, making this a defer-or-monitor issue for most environments.
Exploit ScenarioDerived	An attacker discovers that the /sql/library.sql backup file is publicly accessible via direct HTTP request (e.g., https://target.com/sql/library.sql) due to misconfigured web server permissions. The attacker downloads the unencrypted database backup, which contains user credentials, personal information, and potentially administrative account details. The attacker then uses extracted credentials for further compromise (lateral movement, account takeover) or sells the data. The publicly available exploit proof-of-concept automates discovery of this misconfiguration, reducing the attack complexity to reconnaissance and file retrieval.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Information disclosure in code-projects Online Library Management System 1.0 allows unauthenticated remote attackers to access sensitive data from SQL database backup files via the /sql/library.sql component, requiring user interaction (clicking a link or similar action). The vulnerability has a publicly available exploit and carries a CVSS score of 4.3 with an exploit proof-of-concept (E:P) rating, making it a low-to-moderate priority issue with confirmed public discoverability but limited real-world attack surface due to interaction requirements.

RemediationAI

Immediately remove or restrict access to the /sql/ directory and all backup files (.sql, .db, .bak, etc.) from web-accessible locations, preferably by moving them outside the web root or implementing strict .htaccess (Apache) or web.config (IIS) rules to deny public access. Upgrade to a patched version if available from code-projects.org; however, no specific fix version is provided in the available data, so contact the vendor directly for patch status. As an interim measure, disable directory listing and implement authentication controls on the /sql/ directory. Review database backup procedures to ensure sensitive data is encrypted or access-controlled. Detailed vulnerability information and proof-of-concept analysis are available at https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Online%20Library%20Management%20System%20PHP%20Exposed%20Database%20Backup.md.

Affected VersionsENISA

Online Library Management System 1.0

Affected Packages

euvd online_library_management_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the SQL Database Backup File Handler component of the Online Library Management System, specifically within the /sql/library.sql file. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that backup or configuration files containing database credentials, user data, or other sensitive information are either directly accessible or improperly protected from public access. This is a common misconfiguration in PHP-based web applications where database backup files are stored in web-accessible directories without proper access controls or file extension restrictions. The affected product is code-projects Online Library Management System version 1.0 (CPE: cpe:2.3:a:code-projects:online_library_management_system:*:*:*:*:*:*:*:*).

Know when Online Library Management System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

PoC Detected

Apr 10, 2026 - 03:16 vuln.today

Public exploit code

CVE Published

Apr 10, 2026 - 02:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact· derived

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +10

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.