Is there a public PoC exploit available for CVE-2026-7143?

Yes, a public proof-of-concept exploit is available for CVE-2026-7143. Prioritise patching immediately. EPSS: 0.0%.

1000 Projects Portfolio MCA CVE-2026-7143

Q: What is the CVSS score of CVE-2026-7143?

CVE-2026-7143 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25894 LOW

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi Portfolio Management System Mca

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible admin interface requires authentication; SQL injection impact bounded by database permission model to data confidentiality and limited integrity changes, no availability risk.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:51 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 18:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 18:00 euvd

EUVD-2026-25894

CVE Published

Apr 27, 2026 - 17:15 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in 1000 Projects Portfolio Management System MCA up to 1.0. This affects an unknown function of the file /admin/block_status.php. The manipulation of the argument q leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in 1000 Projects Portfolio Management System MCA up to version 1.0 allows authenticated remote attackers to access and potentially modify database contents via the q parameter in /admin/block_status.php. Publicly available exploit code exists, though no confirmed active exploitation is documented. The vulnerability poses minimal real-world risk due to EPSS score of 0.03% and requirement for prior authentication, with impact limited to low-level data disclosure and modification.

Technical ContextAI

The vulnerability is a SQL injection (CWE-89) in the PHP-based admin interface file /admin/block_status.php. The application fails to sanitize or parameterize the q query parameter before inclusion in SQL queries, allowing injection of arbitrary SQL syntax. Affected versions are identified via CPE cpe:2.3:a:1000_projects:portfolio_management_system_mca. The constrained impact profile (VC:L, VI:L, VA:L) suggests the database user context runs with restrictive permissions, preventing escalation to data destruction or system compromise.

RemediationAI

No vendor-released patch identified at time of analysis. Contact vendor at https://1000projects.org/ to request security update or timeline for release. Interim mitigations: (1) Restrict network access to /admin/block_status.php to trusted IP ranges or VPN only - limits attack surface to insiders or compromised network positions; (2) Enforce multi-factor authentication on all admin accounts - increases cost of credential theft; (3) Implement database query logging and set up alerts for SQL syntax in q parameter - provides detection and investigation capability. If the Portfolio Management System MCA is not actively used, disable the admin interface entirely until patch is released.