Is there a public PoC exploit available for EUVD-2026-17353?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17353. Prioritise patching immediately. EPSS: 0.0%.

PHP EUVD-2026-17353

Q: What is the CVSS score of EUVD-2026-17353?

EUVD-2026-17353 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5197 LOW

SQL Injection (CWE-89)

2026-03-31 VulDB

GHSA-382h-mgg9-q9m2

PHP SQLi Student Membership System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 10:15 euvd

EUVD-2026-17353

Analysis Generated

Mar 31, 2026 - 10:15 vuln.today

CVE Published

Mar 31, 2026 - 10:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of the file /delete_user.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in code-projects Student Membership System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /delete_user.php, enabling unauthorized data exfiltration or manipulation. The vulnerability has CVSS score 5.3 (medium severity) with publicly available exploit code, though it requires authenticated access (PR:L) and carries low confidentiality, integrity, and availability impact per CVSS v4.0 assessment.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in a PHP-based Student Membership System. The /delete_user.php endpoint fails to sanitize or parameterize user-supplied input in the ID parameter before embedding it into SQL queries. This allows an authenticated user to inject malicious SQL syntax, potentially bypassing intended query logic to read, modify, or delete database records beyond their authorization scope. The affected product is identified via CPE as code-projects Student Membership System version 1.0 and potentially earlier/later versions with the same vulnerable code pattern.

RemediationAI

Organizations running Student Membership System 1.0 should immediately review available security updates from code-projects at code-projects.org; no specific patched version number is confirmed in available data, so contact the vendor directly or monitor their security advisories for a fixed release. As an interim control pending patch deployment, restrict network access to /delete_user.php to trusted administrative accounts and implement Web Application Firewall (WAF) rules to detect and block SQL injection payloads in the ID parameter (e.g., rules detecting UNION, OR, comments). Implement parameterized queries or prepared statements in any custom deployments. For detailed vulnerability information and proof-of-concept analysis, refer to VulDB entry 354295 and the public exploit repository linked in references.