Is there a public PoC exploit available for CVE-2026-7089?

Yes, a public proof-of-concept exploit is available for CVE-2026-7089. Prioritise patching immediately. EPSS: 0.0%.

code-projects Home Service System CVE-2026-7089

Q: What is the CVSS score of CVE-2026-7089?

CVE-2026-7089 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25773 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-27 VulDB

PHP XSS Home Service System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 06:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 06:00 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 05:45 euvd

EUVD-2026-25773

Analysis Generated

Apr 27, 2026 - 05:45 vuln.today

CVE Published

Apr 27, 2026 - 05:00 nvd

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in code-projects Home Service System 1.0. The impacted element is an unknown function of the file /booking.php of the component Appointment Booking. The manipulation of the argument fname/lname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Cross-site scripting (XSS) vulnerability in code-projects Home Service System 1.0 allows remote attackers to inject malicious scripts via the fname and lname parameters in the /booking.php Appointment Booking component. User interaction is required for exploitation. A public exploit is available, and the vulnerability carries moderate risk (CVSS 4.3) with integrity impact through malicious script execution in victim browsers.

Technical ContextAI

The vulnerability exists in the /booking.php file's Appointment Booking component, which fails to properly sanitize user-supplied input in the fname (first name) and lname (last name) parameters. This represents a Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) where unsanitized user input is reflected or stored in the web application's response without proper HTML encoding or output validation. The vulnerability affects all versions of code-projects Home Service System built on PHP, where the booking form processes appointment requests without implementing Content Security Policy headers or input validation filters.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate remediation requires manual code hardening: implement proper input validation and HTML entity encoding on fname and lname parameters in /booking.php using PHP functions such as htmlspecialchars() with ENT_QUOTES flag before any output to HTML context, or use a parameterized templating engine. As a compensating control, implement Content Security Policy (CSP) headers with script-src restrictions to prevent inline script execution, though this will not eliminate the XSS injection itself. Apply output encoding library (e.g., OWASP ESAPI for PHP) to all user-supplied appointment booking data. If immediate code patching is not possible, disable or restrict access to the /booking.php component via web server rewrite rules or firewall rules until the application can be updated. Contact code-projects.org for security patch availability or consider migrating to an actively maintained home service booking system if no remediation is forthcoming.