Is there a public PoC exploit available for CVE-2026-6161?

Yes, a public proof-of-concept exploit is available for CVE-2026-6161. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6161

Q: What is the CVSS score of CVE-2026-6161?

CVE-2026-6161 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21854 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-658j-rfvq-5wqq

PHP SQLi Simple Chatbox Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 05:27 vuln.today

Severity Changed

Apr 13, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 05:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 05:15 euvd

EUVD-2026-21854

Analysis Generated

Apr 13, 2026 - 05:15 vuln.today

CVE Published

Apr 13, 2026 - 04:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoint. Executing a manipulation of the argument msg can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in code-projects Simple ChatBox up to version 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via manipulation of the msg parameter in the /chatbox/insert.php endpoint, leading to confidentiality and integrity compromise. The vulnerability has a CVSS score of 6.9 and publicly available exploit code exists, increasing real-world risk despite the moderate base score.

Technical ContextAI

Simple ChatBox is a PHP-based chat application vulnerable to SQL injection (CWE-89) in the insert.php endpoint handler. The vulnerability stems from insufficient input validation on the msg parameter, allowing attackers to inject malicious SQL syntax directly into database queries. The affected component processes user-supplied message input without proper parameterized queries or escaping, a common flaw in legacy PHP applications that directly concatenate user input into SQL statements. The CPE cpe:2.3:a:code-projects:simple_chatbox:*:*:*:*:*:*:*:* indicates the vulnerability affects all versions of the application, with explicit confirmation through version 1.0.

RemediationAI

The primary mitigation is to upgrade Simple ChatBox to a version released after 1.0 if available from the vendor at https://code-projects.org/, or immediately discontinue use of the affected application if no patched version exists. Urgent remediation options include implementing a Web Application Firewall (WAF) with SQL injection signatures to filter malicious msg parameter payloads at the application gateway, applying strict input validation and parameterized query frameworks to the insert.php endpoint, and restricting network access to the /chatbox/insert.php endpoint to trusted IP ranges until patching is possible. Review the VulDB advisory at https://vuldb.com/vuln/357041 for additional mitigation guidance and monitoring signatures.