Is there a public PoC exploit available for CVE-2026-6183?

Yes, a public proof-of-concept exploit is available for CVE-2026-6183. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6183

Q: What is the CVSS score of CVE-2026-6183?

CVE-2026-6183 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21981 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-66h2-jv8h-987w

PHP SQLi Simple Content Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 15:44 vuln.today

Severity Changed

Apr 13, 2026 - 15:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 15:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 15:15 euvd

EUVD-2026-21981

Analysis Generated

Apr 13, 2026 - 15:15 vuln.today

CVE Published

Apr 13, 2026 - 14:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functionality of the file /web/index.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in code-projects Simple Content Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /web/index.php and execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Publicly available exploit code exists and the vulnerability carries a CVSS 6.9 score reflecting moderate confidentiality, integrity, and availability impact across the network-accessible endpoint.

Technical ContextAI

The vulnerability exists in a PHP-based content management system where user-supplied input from the ID parameter is not properly sanitized before being incorporated into SQL queries. This is a classic SQL injection flaw (CWE-89) affecting the query construction logic in /web/index.php. The CPE cpe:2.3:a:code-projects:simple_content_management_system:*:*:*:*:*:*:*:* indicates all versions and configurations of the Simple Content Management System from code-projects are potentially affected. The attack vector is network-based with low attack complexity, requiring no authentication or user interaction, making it trivially exploitable by remote attackers.

RemediationAI

Organizations must immediately upgrade to a patched version of Simple Content Management System if available from code-projects.org, or implement immediate mitigations if no patch has been released. Primary mitigation is to apply parameterized queries (prepared statements) with bound parameters for all SQL operations, particularly those processing the ID parameter in /web/index.php. Implement input validation and whitelist acceptable ID formats (e.g., numeric-only if IDs are integers). Apply Web Application Firewall (WAF) rules to detect and block common SQL injection payloads. Restrict database user permissions to minimum required privileges. See VulDB reference at https://vuldb.com/vuln/357106 for additional technical details and patch status information.