Is there a public PoC exploit available for CVE-2026-6202?

Yes, a public proof-of-concept exploit is available for CVE-2026-6202. Prioritise patching immediately. EPSS: 0.0%.

Easy Blog Site CVE-2026-6202

Q: What is the CVSS score of CVE-2026-6202?

CVE-2026-6202 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22069 LOW

SQL Injection (CWE-89)

2026-04-13 VulDB

PHP SQLi Easy Blog Site Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQL injection requiring a low-privilege authenticated session (PR:L); limited and application-scoped confidentiality, integrity, and availability impact with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:03 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 13, 2026 - 20:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 19:30 euvd

EUVD-2026-22069

CVE Published

Apr 13, 2026 - 19:15 nvd

LOW 2.1

DescriptionCVE.org

A security flaw has been discovered in code-projects Easy Blog Site 1.0. This affects an unknown function of the file post.php. Performing a manipulation of the argument tags results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in code-projects Easy Blog Site 1.0 allows authenticated remote attackers to manipulate database queries via the unsanitized tags parameter in post.php. A public proof-of-concept exploit is available on GitHub, though EPSS of 0.03% (8th percentile) and SSVC's 'not automatable' classification indicate targeted rather than widespread exploitation risk. No CISA KEV listing; real-world exposure is further constrained by the niche, educational-grade deployment footprint of this PHP blogging application.

Technical ContextAI

Easy Blog Site 1.0 is a PHP-based blogging application from code-projects.org (CPE: cpe:2.3:a:code-projects:easy_blog_site:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that the tags argument submitted to post.php is incorporated into a backend SQL query without parameterization or adequate sanitization - a classic prepared-statement omission common in educational PHP projects. The attack surface is the post creation or editing workflow, where tag values are passed directly to a database layer that concatenates input into query strings. No framework or ORM abstraction appears to be protecting this endpoint.

RemediationAI

No vendor-released patch has been identified at time of analysis; given the educational and hobbyist nature of code-projects.org software, an official fix is unlikely to be forthcoming. The primary remediation is to remove or take offline any internet-facing deployment of Easy Blog Site 1.0 entirely - the application's lack of maintenance makes continued exposure difficult to justify. If removal is not immediately possible, restrict access to post.php to trusted, authenticated sessions only via server-level access controls (e.g., IP allowlist at the web server or firewall layer), accepting the trade-off of reduced functionality for external contributors. Deploying a Web Application Firewall rule to block SQL metacharacter sequences in the tags POST parameter provides a compensating control, though WAF bypass is possible for a determined attacker. The definitive developer-side fix would be refactoring post.php to use PDO prepared statements with bound parameters. POC reference: https://github.com/Learner636/CVE-smbmit/issues/6. VulDB advisory: https://vuldb.com/vuln/357124.