Is there a public PoC exploit available for CVE-2026-6153?

Yes, a public proof-of-concept exploit is available for CVE-2026-6153. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6153

Q: What is the CVSS score of CVE-2026-6153?

CVE-2026-6153 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21806 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-4cv5-mvfx-4w7p

PHP SQLi Vehicle Showroom Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 04:23 vuln.today

Severity Changed

Apr 13, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 04:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 04:15 euvd

EUVD-2026-21806

Analysis Generated

Apr 13, 2026 - 04:15 vuln.today

CVE Published

Apr 13, 2026 - 02:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /util/StaffDetailsFunction.php. Such manipulation of the argument STAFF_ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the STAFF_ID parameter in /util/StaffDetailsFunction.php, enabling unauthorized database access with limited confidentiality and integrity impact. Public exploit code is available, and the vulnerability has a CVSS score of 6.9 with confirmed exploitability.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in PHP code that fails to properly sanitize or parameterize user input in the STAFF_ID parameter before constructing database queries. The affected file StaffDetailsFunction.php processes the STAFF_ID argument without using prepared statements or input validation, allowing attackers to inject malicious SQL syntax directly into the query. This type of flaw is fundamental in backend web applications where untrusted user input is concatenated into SQL statements. The CPE identifies code-projects Vehicle Showroom Management System across all versions as vulnerable, suggesting the flaw exists in the base codebase without version-specific constraints noted.

RemediationAI

Immediately upgrade or patch the Vehicle Showroom Management System to a version released after this vulnerability disclosure (consult code-projects.org for the latest patched release). The primary fix is to replace all dynamic SQL query construction in StaffDetailsFunction.php and related database interaction code with prepared statements or parameterized queries using PHP MySQLi prepared statements or PDO with bound parameters. Implement input validation on the STAFF_ID parameter to accept only expected integer values or alphanumeric staff identifiers, rejecting any SQL special characters. Apply Web Application Firewall (WAF) rules to block SQL injection patterns in the STAFF_ID parameter as a temporary mitigation until patching is completed. Review vendor advisory at https://vuldb.com/vuln/357033 for additional guidance.