Is there a public PoC exploit available for CVE-2026-86519?

Yes, a public proof-of-concept exploit is available for CVE-2026-86519. Prioritise patching immediately. EPSS: 0.3%.

Student Crud Operation CVE-2026-86519

Q: What is the CVSS score of CVE-2026-86519?

CVE-2026-86519 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-72642 MEDIUM

Information Exposure (CWE-200)

2026-09-08 VulDB

GHSA-x6mq-x9h9-6h98

Information Disclosure Code Projects Student Crud Operation

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible static file fetch requires no auth or interaction; only partial confidentiality loss, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 08, 2026 - 05:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Sep 08, 2026 - 05:00 vuln.today

CVE Published

Sep 08, 2026 - 04:00 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used.

AnalysisAI

Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump /card_activation.sql from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions are required beyond the application being deployed on an internet-facing web server and the SQL file remaining in the web root as distributed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) accurately reflects a remotely exploitable, zero-prerequisite information disclosure with limited confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis - code-projects.org has not issued an update. … Detailed patch versions, workarounds, and compensating controls in full report.