Is there a public PoC exploit available for CVE-2026-7072?

Yes, a public proof-of-concept exploit is available for CVE-2026-7072. Prioritise patching immediately. EPSS: 0.0%.

CodePanda Canteen Management System CVE-2026-7072

Q: What is the CVSS score of CVE-2026-7072?

CVE-2026-7072 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25748 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 01:29 vuln.today

Severity Changed

Apr 27, 2026 - 01:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 01:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 01:15 euvd

EUVD-2026-25748

Analysis Generated

Apr 27, 2026 - 01:15 vuln.today

CVE Published

Apr 27, 2026 - 00:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in CodePanda Source canteen_management_system 1.0. Affected by this issue is some unknown functionality of the file /api/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

Remote SQL injection in CodePanda Source canteen_management_system 1.0 allows unauthenticated attackers to manipulate the Username parameter in /api/login.php, enabling arbitrary database queries. Public exploit code is available. The vulnerability affects confidentiality and integrity with low impact scope, making it a practical attack vector for credential harvesting or data exfiltration from the canteen management database.

Technical ContextAI

The vulnerability stems from improper input sanitization in the login endpoint (/api/login.php), where the Username parameter is directly concatenated into SQL queries without parameterized statements or prepared statements. This is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The PHP application fails to escape or validate user-supplied input before passing it to the database driver, allowing attackers to break out of the intended SQL context and inject arbitrary SQL syntax. The attack vector is network-based with low complexity, indicating no special crafting or authentication is required-any remote user can send a malicious HTTP request with a crafted username string.

RemediationAI

Immediate action required: upgrade to a patched version if available from CodePanda Source, or contact the vendor for security updates. No specific patched version was confirmed in the provided data, so verify with the vendor or check their security advisory page at https://vuldb.com/vuln/359647. As an interim compensating control, implement strict input validation and parameterized queries in /api/login.php: replace all SQL string concatenation with prepared statements using bind parameters (e.g., PDO prepared statements or MySQLi prepared queries in PHP). Additionally, enforce a Web Application Firewall (WAF) rule to block requests containing SQL metacharacters (single quotes, semicolons, comment sequences) in the Username parameter; note that this may block legitimate usernames containing special characters-test thoroughly before deployment. Restrict database user privileges so the account used by the application has SELECT-only access to the users table and cannot execute administrative commands (ALTER, DROP, etc.), limiting the scope of data an attacker can modify. Monitor login attempts for unusual SQL syntax patterns and log all failed authentications for post-incident analysis.