Is there a public PoC exploit available for CVE-2026-6010?

Yes, a public proof-of-concept exploit is available for CVE-2026-6010. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6010

Q: What is the CVSS score of CVE-2026-6010?

CVE-2026-6010 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21301 LOW

SQL Injection (CWE-89)

2026-04-10 VulDB

GHSA-42q7-q9v4-qq54

PHP SQLi Online Classroom Codeastro

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 04:17 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 03:45 euvd

EUVD-2026-21301

Analysis Generated

Apr 10, 2026 - 03:45 vuln.today

CVE Published

Apr 10, 2026 - 03:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Online Classroom 1.0/2.php. Affected by this vulnerability is an unknown functionality of the file /OnlineClassroom/takeassessment2.php?exid=14. Performing a manipulation of the argument Q1 results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in CodeAstro Online Classroom allows authenticated remote attackers to execute arbitrary SQL queries via the Q1 parameter in /OnlineClassroom/takeassessment2.php, enabling data exfiltration and modification with CVSS 6.3 severity; publicly available exploit code exists and the vulnerability affects all versions of the product.

Technical ContextAI

CodeAstro Online Classroom is a PHP-based web application for educational assessment management. The vulnerability resides in the takeassessment2.php endpoint, which processes the Q1 parameter without proper input validation or parameterized query preparation. This is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) where user-supplied input is directly concatenated into SQL statements. The affected file path /OnlineClassroom/takeassessment2.php?exid=14 suggests an exam or assessment ID is passed as a query parameter, and the Q1 field (likely a question/answer field) fails to sanitize or escape special SQL characters before database execution.

RemediationAI

Immediate mitigation requires upgrading to a patched version of CodeAstro Online Classroom; however, no specific patched version has been independently confirmed at time of analysis. Administrators should contact CodeAstro directly at codeastro.com for security advisories and patched releases. As an interim workaround, implement Web Application Firewall (WAF) rules to block SQL injection patterns in the Q1 parameter (e.g., detecting single quotes, SQL keywords like UNION, SELECT, OR, --), restrict database user privileges to read-only where possible, and disable direct internet exposure of the /OnlineClassroom path using network segmentation or IP allowlisting. Developers should remediate this by using parameterized queries (prepared statements) for all SQL operations, validating and strictly typing the Q1 input on the server side, and implementing principle of least privilege for the database user account. Consult VulDB (https://vuldb.com/vuln/356566) for detailed technical analysis and patch availability updates.