Is there a public PoC exploit available for CVE-2026-6167?

Yes, a public proof-of-concept exploit is available for CVE-2026-6167. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6167

Q: What is the CVSS score of CVE-2026-6167?

CVE-2026-6167 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21891 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-83p9-7gqh-59qj

PHP SQLi Faculty Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 07:29 vuln.today

Severity Changed

Apr 13, 2026 - 07:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 07:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 07:15 euvd

EUVD-2026-21891

Analysis Generated

Apr 13, 2026 - 07:15 vuln.today

CVE Published

Apr 13, 2026 - 06:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in code-projects Faculty Management System 1.0. Impacted is an unknown function of the file /subject-print.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Faculty Management System 1.0 via the ID parameter in /subject-print.php allows unauthenticated remote attackers to execute arbitrary SQL queries and exfiltrate or modify database contents with low confidentiality and integrity impact. Publicly available exploit code exists, creating immediate operational risk for organizations running this system.

Technical ContextAI

The vulnerability stems from CWE-89 (SQL Injection), a classic input validation failure where user-supplied data (the ID parameter) is concatenated into SQL queries without proper parameterization or escaping. The affected product is code-projects Faculty Management System (CPE: cpe:2.3:a:code-projects:faculty_management_system:*:*:*:*:*:*:*:*), a PHP-based web application. The /subject-print.php endpoint directly processes the ID parameter and passes it to database operations, allowing attackers to inject SQL metacharacters and alter query logic. This is a fundamental web application flaw that bypasses SQL parsing boundaries when dynamic query construction is used instead of prepared statements.

RemediationAI

Immediate action required: upgrade to a patched version of code-projects Faculty Management System (specific patched version not confirmed from available data; check code-projects.org advisory at https://code-projects.org/ for the latest release). The primary fix is input validation and parameterized queries: replace all dynamic SQL construction in /subject-print.php with prepared statements using bound parameters. Until a vendor patch is released, implement a Web Application Firewall (WAF) rule to block requests containing SQL metacharacters (single quotes, double dashes, UNION, SELECT, etc.) in the ID parameter. Additionally, apply principle of least privilege to the database account used by the application to restrict what queries can modify or extract. Review VulDB submission at https://vuldb.com/submit/797098 for detailed technical remediation guidance.