Is there a public PoC exploit available for EUVD-2026-25895?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25895. Prioritise patching immediately. EPSS: 0.0%.

Portfolio Management System MCA EUVD-2026-25895

Q: What is the CVSS score of EUVD-2026-25895?

EUVD-2026-25895 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7144 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-27 VulDB

PHP Authentication Bypass Portfolio Management System Mca

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Requires authenticated session (PR:L); IDOR allows changing another user's password (I:L); no confidentiality or availability impact; scope unchanged within the application.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:07 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 18:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 18:00 euvd

EUVD-2026-25895

CVE Published

Apr 27, 2026 - 17:30 nvd

LOW 2.1

DescriptionCVE.org

A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown function of the file update_passwd_process.php. The manipulation of the argument temp_user results in authorization bypass. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Authorization bypass in 1000 Projects Portfolio Management System MCA 1.0 allows authenticated remote attackers to modify other users' passwords via the temp_user parameter in update_passwd_process.php. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), enabling horizontal privilege escalation at the application layer. A publicly available proof-of-concept exploit exists on GitHub, though EPSS at 0.03% (7th percentile) and SSVC's 'not automatable' designation indicate limited mass-exploitation risk; no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The affected product is the PHP-based 1000 Projects Portfolio Management System MCA 1.0, identified by CPE cpe:2.3:a:1000_projects:portfolio_management_system_mca:*:*:*:*:*:*:*:*. The vulnerability resides in update_passwd_process.php, a PHP script handling account password updates. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a class of Insecure Direct Object Reference (IDOR) flaw where the application uses an attacker-controlled value - here the temp_user parameter - as a direct reference to an internal resource (user account) without enforcing server-side ownership validation. This means the application trusts the client-supplied temp_user identifier to scope which account's password to change, rather than binding the operation to the authenticated session's own identity.

RemediationAI

No vendor-released patch has been identified at time of analysis. The vendor's product page is https://1000projects.org/, but no security advisory or patched release appears in the available references. As compensating controls: restrict access to update_passwd_process.php via web server configuration such as IP allowlisting or by requiring re-authentication at the endpoint level - this reduces exposure without disabling the feature entirely. Developers should enforce server-side validation that the temp_user parameter matches only the authenticated session's own user identity before processing any password change, eliminating the IDOR root cause. Alternatively, disabling the password-change functionality entirely until a fix is available is the most conservative option, at the cost of requiring administrator-mediated password resets. The public POC is documented at https://github.com/9str0IL/CVE/issues/4 and should be reviewed to understand the exact attack surface.