Is there a public PoC exploit available for CVE-2026-6163?

Yes, a public proof-of-concept exploit is available for CVE-2026-6163. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6163

Q: What is the CVSS score of CVE-2026-6163?

CVE-2026-6163 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21874 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-6vp8-f7xg-8xgc

PHP SQLi Lost And Found Thing Management Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 06:29 vuln.today

Severity Changed

Apr 13, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 06:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 06:15 euvd

EUVD-2026-21874

Analysis Generated

Apr 13, 2026 - 06:15 vuln.today

CVE Published

Apr 13, 2026 - 05:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in code-projects Lost and Found Thing Management 1.0. Affected by this issue is some unknown functionality of the file /catageory.php. Such manipulation of the argument cat leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in code-projects Lost and Found Thing Management 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the cat parameter in /catageory.php, enabling data exfiltration and potential database manipulation. The vulnerability has a publicly available exploit and carries a CVSS score of 6.9 with confirmed low impact to confidentiality, integrity, and availability. Active exploitation status has not been confirmed at time of analysis, but the accessible nature of the vulnerability and public exploit availability elevate operational risk.

Technical ContextAI

This is a classical SQL injection vulnerability (CWE-89) in a PHP-based Lost and Found management application. The vulnerability exists in the /catageory.php file where user-supplied input from the cat parameter is passed unsanitized into SQL queries. The application fails to employ parameterized queries or input validation, allowing attackers to inject arbitrary SQL commands. The attack vector is network-accessible with low complexity, meaning the exploit requires minimal effort and no special conditions beyond network access. The CPE cpe:2.3:a:code-projects:lost_and_found_thing_management:*:*:*:*:*:*:*:* indicates all versions of the Lost and Found Thing Management application from code-projects are affected.

RemediationAI

The primary remediation is to upgrade to a patched version if available from code-projects.org. Given no specific patched version has been confirmed from the provided references, contact code-projects.org or monitor their advisory pages at https://code-projects.org/ for a security update. Immediate workarounds include applying a Web Application Firewall (WAF) rule to block requests containing SQL keywords or special characters in the cat parameter, disabling the /catageory.php endpoint if not required, or implementing input validation and parameterized queries in the application code if you maintain a local fork. Implement principle of least privilege on the database account used by the application to limit the scope of SQL injection impact.