Which versions of PHP are affected by CVE-2026-6148?

CVE-2026-6148 is a critical SQL injection vulnerability in Vehicle Showroom Management System 1.0 that allows unauthenticated attackers to directly access, modify, or delete the entire database…

Is there a public PoC exploit available for CVE-2026-6148?

Yes, a public proof-of-concept exploit is available for CVE-2026-6148. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6148?

Within 24 hours: Immediately audit network access logs for MonthTotalReportUpdateFunction.php requests and identify all instances of Vehicle Showroom Management System 1.0 on your network and internet perimeter. Within 7 days: Isolate affected systems from internet access via firewall rules blocking external traffic to the application, or take systems offline if critical business function permits. Contact the vendor for timeline to available patch or security update. Within 30 days: Implement database access controls, conduct forensic analysis of logs and backups to identify unauthorized access or data exfiltration, and migrate to a patched version or replacement system when available.

PHP CVE-2026-6148

Q: What is the CVSS score of CVE-2026-6148?

CVE-2026-6148 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21774 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-v36w-f92j-7386

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 13, 2026 - 02:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 02:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 02:04 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 02:00 euvd

EUVD-2026-21774

Analysis Generated

Apr 13, 2026 - 02:00 vuln.today

CVE Published

Apr 13, 2026 - 01:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the BRANCH_ID parameter in MonthTotalReportUpdateFunction.php. Publicly available exploit code exists (GitHub POC published), enabling trivial exploitation with no user interaction required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed application via Shodan/Google dorking

Delivery

Send crafted HTTP POST to MonthTotalReportUpdateFunction.php

Exploit

Inject SQL payload via BRANCH_ID parameter

Execution

Execute unauthorized database queries

Persist

Extract credentials and business data

Impact

Escalate to system compromise or data exfiltration

Access

Identify exposed application via Shodan/Google dorking

Delivery

Send crafted HTTP POST to MonthTotalReportUpdateFunction.php

Exploit

Inject SQL payload via BRANCH_ID parameter

Execution

Execute unauthorized database queries

Persist

Extract credentials and business data

Impact

Escalate to system compromise or data exfiltration

Vulnerability AssessmentAI

Risk Assessment	Real-world risk is HIGH for organizations running this specific application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker identifies an internet-exposed Vehicle Showroom Management System instance through search engine reconnaissance or automated scanning. Using the publicly available GitHub POC, the attacker crafts a malicious HTTP request to MonthTotalReportUpdateFunction.php with a SQL injection payload in the BRANCH_ID parameter (e.g., BRANCH_ID=1' UNION SELECT username,password,3 FROM admin_users--). …
Remediation	No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Immediately audit network access logs for MonthTotalReportUpdateFunction.php requests and identify all instances of Vehicle Showroom Management System 1.0 on your network and internet perimeter. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-49952 CRITICAL Act Now POC

9.3 Jun 15

Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce

CVE-2026-49954 HIGH This Week POC

8.6 Jun 15

Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a

CVE-2026-49768 CRITICAL Act Now

9.8 Jun 15

Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to

CVE-2026-27053 CRITICAL Act Now

9.8 Jun 15

Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot

CVE-2026-49104 CRITICAL Act Now

9.8 Jun 15

Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo

CVE-2026-6148 vulnerability details – vuln.today

Back

PHP CVE-2026-6148

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More from same product – last 7 days

Share

External POC / Exploit Code