Is there a public PoC exploit available for CVE-2026-6162?

Yes, a public proof-of-concept exploit is available for CVE-2026-6162. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6162

Q: What is the CVSS score of CVE-2026-6162?

CVE-2026-6162 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21855 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-13 VulDB

GHSA-rqvj-x8vr-qv55

PHP XSS Company Visitor Management System Phpgurukul

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 05:28 vuln.today

Severity Changed

Apr 13, 2026 - 05:22 NVD

LOW MEDIUM

CVSS changed

Apr 13, 2026 - 05:22 NVD

3.5 (LOW) 5.1 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 05:15 euvd

EUVD-2026-21855

Analysis Generated

Apr 13, 2026 - 05:15 vuln.today

CVE Published

Apr 13, 2026 - 05:00 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability has been found in PHPGurukul Company Visitor Management System 2.0. This impacts an unknown function of the file /bwdates-reports-details.php. The manipulation of the argument fromdate leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Reflected cross-site scripting (XSS) in PHPGurukul Company Visitor Management System 2.0 allows authenticated remote attackers to inject malicious scripts via the fromdate parameter in /bwdates-reports-details.php. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), but publicly available exploit code exists, elevating practical risk despite the moderate CVSS score of 5.1.

Technical ContextAI

The vulnerability is a classic reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based visitor management application. The fromdate parameter in the /bwdates-reports-details.php endpoint fails to sanitize or encode user-supplied input before rendering it in the HTTP response. This allows attackers to craft malicious URLs containing JavaScript payloads that execute in the context of authenticated users' browsers. The affected product, identified via CPE cpe:2.3:a:phpgurukul:company_visitor_management_system:*:*:*:*:*:*:*:*, is a web application built on PHP, making server-side input validation and output encoding critical controls.

RemediationAI

The primary remediation is to upgrade to a patched version released by PHPGurukul; however, no specific patched version number has been independently confirmed in available data. Organizations should contact PHPGurukul directly or check https://phpgurukul.com/ for security updates. As an interim workaround, implement input validation on the fromdate parameter by requiring it to match a strict date format (e.g., YYYY-MM-DD via regex) and apply output encoding (HTML entity encoding or URL encoding) to all user-supplied values before rendering them in HTML contexts. Additionally, enforce Content Security Policy (CSP) headers with script-src restrictions to mitigate reflected XSS impact even if input validation is bypassed. Review access controls to the /bwdates-reports-details.php endpoint and restrict it to necessary authenticated users only.