Which versions of PHP are affected by CVE-2026-6595?

ProjectsAndPrograms School Management System contains a critical SQL injection vulnerability in its bus location module that allows unauthenticated attackers to access, modify, or destroy the entire…

Is there a public PoC exploit available for CVE-2026-6595?

Yes, a public proof-of-concept exploit is available for CVE-2026-6595. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6595?

Within 24 hours: Take the affected buslocation.php module offline or restrict network access to it; identify all instances of ProjectsAndPrograms running versions up to commit 6b6fae5 across your infrastructure. Within 7 days: Contact the vendor for emergency support status; evaluate alternative school management systems or conduct a comprehensive code audit of the SQL injection point by qualified security personnel. Within 30 days: Implement a Web Application Firewall (WAF) with SQL injection rules as interim protection, or migrate to a patched or alternative solution; conduct full database integrity audit for unauthorized access.

PHP CVE-2026-6595

Q: What is the CVSS score of CVE-2026-6595?

CVE-2026-6595 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23743 MEDIUM

SQL Injection (CWE-89)

2026-04-20 VulDB

GHSA-f674-pjwp-7q42

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 20, 2026 - 03:22 NVD

HIGH MEDIUM

CVSS changed

Apr 20, 2026 - 03:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 02:49 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 02:45 euvd

EUVD-2026-23743

Analysis Generated

Apr 20, 2026 - 02:45 vuln.today

CVE Published

Apr 20, 2026 - 02:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This vulnerability affects unknown code of the file buslocation.php of the component HTTP GET Parameter Handler. The manipulation of the argument bus_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in ProjectsAndPrograms School Management System allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability via the bus_id parameter in buslocation.php. The vulnerability affects all versions up to commit 6b6fae5, with publicly available exploit code (EPSS not provided). Vendor was notified but did not respond, leaving the product vulnerable at time of analysis. The rolling release model means no fixed version number exists.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based school management application. The buslocation.php script's HTTP GET parameter handler fails to properly sanitize the bus_id input before incorporating it into database queries. SQL injection occurs when user-controlled data is concatenated directly into SQL statements without parameterization or escaping, allowing attackers to manipulate query logic. The affected product (cpe:2.3:a:projectsandprograms:school_management_system) is a PHP application likely using MySQL/MariaDB for backend storage. The vulnerability exists in code handling bus location tracking functionality, suggesting the application manages student transportation logistics. The rolling release delivery model means the codebase continuously evolves without traditional versioned releases.

RemediationAI

No vendor-released patch identified at time of analysis despite early disclosure notification. Vendor did not respond to vulnerability report. Immediate compensating controls required: (1) Implement Web Application Firewall rules to block SQL metacharacters in bus_id parameter (trade-off: may break legitimate edge-case inputs containing quotes/dashes). (2) Restrict buslocation.php access to authenticated admin users only via web server configuration or application access controls (trade-off: breaks anonymous bus tracking features if intended). (3) Deploy database account with read-only permissions for application queries where possible (trade-off: breaks write operations, requires architecture review). (4) Monitor database query logs for UNION, SELECT, OR 1=1 patterns in bus_id context (trade-off: high log volume, requires SIEM integration). Long-term: migrate to alternative school management platform with active security maintenance or fork the codebase and apply parameterized query fixes to buslocation.php GET handler. Reference VulDB entries https://vuldb.com/vuln/358230 and https://vuldb.com/submit/791820 for technical details.