Is there a public PoC exploit available for CVE-2026-6033?

Yes, a public proof-of-concept exploit is available for CVE-2026-6033. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6033

Q: What is the CVSS score of CVE-2026-6033?

CVE-2026-6033 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21336 LOW

SQL Injection (CWE-89)

2026-04-10 VulDB

GHSA-x96m-26ch-mprq

PHP SQLi Online Classroom Codeastro

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 08:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 08:15 euvd

EUVD-2026-21336

Analysis Generated

Apr 10, 2026 - 08:15 vuln.today

CVE Published

Apr 10, 2026 - 07:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /updatedetailsfromstudent.php?eno=146891650. Executing a manipulation of the argument fname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in CodeAstro Online Classroom 1.0 allows authenticated remote attackers to manipulate the fname parameter in /updatedetailsfromstudent.php to execute arbitrary SQL queries, achieving limited confidentiality and integrity impact. The vulnerability has publicly available exploit code and a CVSS score of 5.3, representing a moderate risk requiring authentication to exploit.

Technical ContextAI

The vulnerability exists in a PHP-based file upload or user detail update endpoint (/updatedetailsfromstudent.php) that accepts a student enrollment number (eno) and processes user input through the fname parameter without proper sanitization or parameterized query protection. This is a classic SQL injection flaw (CWE-89) where untrusted user input is concatenated directly into SQL statement construction. The attack vector is network-based with low attack complexity, indicating the vulnerability can be triggered through a simple HTTP request after authentication. CodeAstro Online Classroom (CPE: cpe:2.3:a:codeastro:online_classroom:*:*:*:*:*:*:*:*) is a learning management system written in PHP, and the /updatedetailsfromstudent.php endpoint likely processes student profile updates without using prepared statements or input validation.

RemediationAI

Upgrade CodeAstro Online Classroom to a patched version released by the vendor following this disclosure; consult https://codeastro.com/ and VulDB (https://vuldb.com/vuln/356609) for official patch availability and version numbers. As an immediate workaround pending patch deployment, implement Web Application Firewall (WAF) rules to block SQL injection patterns in the fname parameter, enforce parameterized queries or prepared statements in the /updatedetailsfromstudent.php endpoint, and restrict access to this file to trusted internal networks if the application is not public-facing. Apply input validation to reject special SQL characters (single quotes, semicolons, comments) in the fname field and use database-level access controls to limit the query privileges of the application's database user account.