Is there a public PoC exploit available for EUVD-2026-25821?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25821. Prioritise patching immediately. EPSS: 0.0%.

code-projects Employee Management System EUVD-2026-25821

Q: What is the CVSS score of EUVD-2026-25821?

EUVD-2026-25821 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7115 LOW

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 11:31 vuln.today

CVSS changed

Apr 27, 2026 - 11:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 11:00 euvd

EUVD-2026-25821

Analysis Generated

Apr 27, 2026 - 11:00 vuln.today

CVE Published

Apr 27, 2026 - 10:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file 370project/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to manipulate the ID argument in 370project/delete.php, leading to unauthorized database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; CVSS 5.3 reflects moderate risk limited by authentication requirement and restricted data access scope.

Technical ContextAI

The vulnerability exists in the delete.php file, a common application endpoint for record removal in web-based management systems. The ID parameter is passed directly into SQL queries without proper input sanitization or parameterized statement preparation, exemplifying CWE-89 (SQL Injection). PHP applications processing user-supplied input into SQL commands without encoding or prepared statements are particularly vulnerable. The CPE designation indicates all versions of the product before patching are affected, though version 1.0 is explicitly confirmed vulnerable.

RemediationAI

Immediate action: upgrade to a patched version released by code-projects (version number not confirmed in available advisories - contact vendor at code-projects.org for confirmed patch release). If upgrade is not immediately available, implement compensating controls: (1) restrict network access to 370project/delete.php via firewall or Web Application Firewall (WAF) rules to internal IP ranges only, reducing AV:N to effectively AV:L; (2) enforce strict input validation on the ID parameter using whitelist-based validation for expected numeric or alphanumeric formats; (3) implement parameterized SQL statements or prepared statement APIs in the PHP code to prevent SQL injection entirely; (4) apply principle of least privilege to the database user account used by the application, limiting it to DELETE operations only on necessary tables. Each control should be tested thoroughly before deployment to avoid blocking legitimate delete operations.