Is there a public PoC exploit available for CVE-2026-7131?

Yes, a public proof-of-concept exploit is available for CVE-2026-7131. Prioritise patching immediately. EPSS: 0.0%.

Online Lot Reservation System CVE-2026-7131

Q: What is the CVSS score of CVE-2026-7131?

CVE-2026-7131 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25859 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi Online Lot Reservation System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Pre-auth network-accessible login form SQLi with no scope change; CIA impacts are partial, consistent with database-level access but no OS or cross-system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:59 vuln.today

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 15:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 15:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 15:00 euvd

EUVD-2026-25859

CVE Published

Apr 27, 2026 - 14:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in code-projects Online Lot Reservation System up to 1.0. The impacted element is an unknown function of the file /loginuser.php. The manipulation of the argument email/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Online Lot Reservation System 1.0 exposes the pre-authentication login endpoint /loginuser.php to unauthenticated remote database manipulation via the email and password parameters. A public POC has been disclosed on GitHub, though real-world exploitation risk is tempered by an EPSS of 0.03% (9th percentile), SSVC 'Exploitation: none', and the product's obscure deployment footprint. Successful exploitation yields partial compromise of confidentiality, integrity, and availability of the underlying database - consistent with CVSS 4.0 impact ratings of VC:L/VI:L/VA:L.

Technical ContextAI

The affected component is a PHP login handler (/loginuser.php) within the code-projects Online Lot Reservation System, identified by CPE cpe:2.3:a:code-projects:online_lot_reservation_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied email and password form fields are concatenated directly into SQL query strings without sanitization or parameterization, a foundational PHP-era anti-pattern. This class of flaw enables attackers to alter query logic, bypass authentication predicates, or extract arbitrary data from the underlying relational database. The code-projects platform is known for distributing educational and demo-grade PHP applications that frequently lack input validation controls.

RemediationAI

No vendor-released patch has been identified at time of analysis; given the educational nature of code-projects software, a formal fix may not be forthcoming. The most effective remediation is replacing raw SQL string concatenation in /loginuser.php with parameterized queries or prepared statements (e.g., PHP PDO or MySQLi prepared statements), which eliminates the injection vector entirely. If code modification is not feasible, restrict public network access to /loginuser.php via firewall rules or web server access controls (trade-off: disrupts legitimate login access if not scoped to authorized IP ranges). A WAF rule targeting SQL metacharacter patterns in the email and password POST parameters provides a compensating control but may introduce false positives on edge-case valid inputs. If the application is not actively used in production, decommissioning is the lowest-risk resolution. References: https://vuldb.com/vuln/359730 and POC at https://github.com/zzk6th/cve/issues/1.