Is there a public PoC exploit available for CVE-2026-7716?

Yes, a public proof-of-concept exploit is available for CVE-2026-7716. Prioritise patching immediately. EPSS: 0.0%.

Gym Management System in PHP CVE-2026-7716

Q: What is the CVSS score of CVE-2026-7716?

CVE-2026-7716 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26867 LOW

SQL Injection (CWE-89)

2026-05-04 VulDB

Microsoft PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:18 vuln.today

Public exploit code

Analysis Generated

May 04, 2026 - 01:48 vuln.today

Severity Changed

May 04, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

May 04, 2026 - 01:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

May 04, 2026 - 01:15 euvd

EUVD-2026-26867

Analysis Generated

May 04, 2026 - 01:15 vuln.today

CVE Published

May 04, 2026 - 00:45 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in code-projects Gym Management System in PHP allows authenticated remote attackers to manipulate the 'day' parameter in /index.php, enabling arbitrary SQL query execution with limited confidentiality and integrity impact. The vulnerability carries a CVSS score of 2.1 and requires prior authentication (PR:L); publicly available exploit code exists but active exploitation confirmation is absent from CISA KEV data.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) affecting a PHP-based gym management application. The attack vector targets the /index.php file, where the 'day' parameter is passed to a database query without proper input sanitization or parameterized statement preparation. The CVSS 4.0 vector indicates network-accessible PHP code (AV:N) with low attack complexity (AC:L), but requires authenticated session (PR:L), limiting the attack surface to users with valid credentials. The CPE data identifies both the Gym Management System in PHP and an unusual Windows NT CPE entry, though the latter may represent a misclassification or legacy platform annotation by the vulnerability source.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation requires implementing parameterized SQL queries (prepared statements) in /index.php and all database interaction points, ensuring the 'day' parameter and other user inputs are never concatenated directly into SQL strings. Additionally, enforce input validation to accept only expected data types (e.g., numeric or date format for 'day'). Apply principle of least privilege by restricting database account permissions to only necessary operations (SELECT, UPDATE limited to specific tables). For deployments dependent on immediate operational continuity without code changes, implement Web Application Firewall (WAF) rules to block requests containing SQL keywords in the 'day' parameter (trade-off: may trigger false positives on legitimate data). Restrict access to /index.php to known internal IP ranges or VPN endpoints and enforce strong authentication policies to reduce the pool of authenticated users who could exploit this vulnerability. Urgent action: contact code-projects regarding patch availability and estimated remediation timeline.