Is there a public PoC exploit available for CVE-2026-7148?

Yes, a public proof-of-concept exploit is available for CVE-2026-7148. Prioritise patching immediately. EPSS: 0.0%.

Online Classroom CVE-2026-7148

Q: What is the CVSS score of CVE-2026-7148?

CVE-2026-7148 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25907 LOW

SQL Injection (CWE-89)

2026-04-27 VulDB

SQLi Online Classroom Codeastro

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable but requires low-privilege authentication (PR:L); SQL injection yields limited C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:04 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 19:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 19:00 euvd

EUVD-2026-25907

CVE Published

Apr 27, 2026 - 18:30 nvd

LOW 2.1

DescriptionCVE.org

A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in CodeAstro Online Classroom 1.0 exposes the /addnewfaculty endpoint to database manipulation via the unsanitized fname parameter, accessible to authenticated remote attackers. A public exploit has been published on GitHub, though EPSS sits at 0.01% (1st percentile) and SSVC rates the attack as non-automatable with only partial technical impact - signals consistent with a niche, low-footprint application. No CISA KEV listing exists; real-world risk is constrained by the requirement for a low-privilege authenticated session and the limited deployment base of this product.

Technical ContextAI

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes the root cause: user-supplied input to the fname argument in the /addnewfaculty HTTP endpoint is concatenated directly into a SQL query without parameterization or escaping. The CPE cpe:2.3:a:codeastro:online_classroom:*:*:*:*:*:*:*:* covers all versions of CodeAstro's Online Classroom, with version 1.0 explicitly confirmed as affected per EUVD data (EUVD-2026-25907). CodeAstro produces PHP-based educational web applications primarily distributed for academic environments, and this endpoint appears to handle faculty registration, making it accessible to any authenticated user with faculty management permissions.

RemediationAI

No vendor-released patch has been identified at time of analysis. Administrators should monitor https://codeastro.com/ and https://vuldb.com/vuln/359747 for any forthcoming fix. As an immediate compensating control, access to the /addnewfaculty endpoint should be restricted to the minimum required user roles via application-level access controls or web server configuration - this directly limits the pool of accounts capable of triggering the flaw. Deploying a web application firewall (WAF) with SQL injection signatures against POST parameters on this endpoint can provide detection and blocking capability, though WAF bypass is possible and should not be the sole control. The most effective long-term remediation is to refactor the fname parameter handling to use prepared statements with parameterized queries, eliminating the injection surface entirely.