Is there a public PoC exploit available for CVE-2026-7783?

Yes, a public proof-of-concept exploit is available for CVE-2026-7783. Prioritise patching immediately. EPSS: 0.0%.

Perfex CRM CVE-2026-7783

Q: What is the CVSS score of CVE-2026-7783?

CVE-2026-7783 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27155 LOW

SQL Injection (CWE-89)

2026-05-04 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 05, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

May 05, 2026 - 00:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 05, 2026 - 00:00 vuln.today

DescriptionCVE.org

A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanban.php of the component Admin Kanban Endpoint. This manipulation of the argument this causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in CodeCanyon Perfex CRM up to version 3.4.1 allows authenticated remote attackers to execute arbitrary SQL queries via the Admin Kanban Endpoint's AbstractKanban::applySortQuery function. The vulnerability stems from improper sanitization of the sort query argument and can lead to unauthorized data access, modification, and potential system compromise. Publicly available exploit code exists, increasing real-world risk.

Technical ContextAI

The vulnerability exists in the AbstractKanban class within the Admin Kanban component of Perfex CRM, specifically in the applySortQuery method of application/services/AbstractKanban.php. The flaw is classified as CWE-89 (SQL Injection), indicating that user-supplied input is directly concatenated into SQL queries without proper parameterization or escaping. Perfex CRM is a CodeIgniter-based customer relationship management platform written in PHP. The Kanban endpoint is part of the administrative interface and handles task/project organization visualization. The vulnerability allows attackers to inject malicious SQL syntax through the sort query parameter, bypassing standard input validation.

RemediationAI

Upgrade CodeCanyon Perfex CRM to version 3.4.2 or later, which addresses the SQL injection vulnerability in the AbstractKanban::applySortQuery function. Consult the official CodeCanyon Perfex CRM documentation and advisory at https://vuldb.com/vuln/360980 for the specific patch version. Pending patching, implement the following compensating controls: (1) Restrict admin Kanban endpoint access to internal networks only via firewall rules (WAF/NGFW), reducing the network attack vector from AV:N to AV:L in practice; (2) Enforce strong, unique password policies and multi-factor authentication (MFA) for all admin accounts, mitigating the PR:L requirement by reducing credential compromise risk; (3) Apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP parameters passed to /kanban endpoints, such as single quotes, UNION SELECT, and SLEEP() functions-note this is detection-based and may produce false positives; (4) Review admin user logs (via Perfex's built-in audit features if available) to identify suspicious kanban sort query activity. Enable query logging at the database level if available. Note the trade-off: WAF rules may block legitimate administrative bulk-sort operations if not properly tuned.