Is there a public PoC exploit available for EUVD-2026-26478?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26478. Prioritise patching immediately. EPSS: 0.0%.

code-projects Gym Management System EUVD-2026-26478

Q: What is the CVSS score of EUVD-2026-26478?

EUVD-2026-26478 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7553 LOW

SQL Injection (CWE-89)

2026-05-01 VulDB

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 15:26 vuln.today

Public exploit code

Severity Changed

May 01, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 01, 2026 - 05:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

May 01, 2026 - 05:15 vuln.today

EUVD ID Assigned

May 01, 2026 - 05:00 euvd

EUVD-2026-26478

Analysis Generated

May 01, 2026 - 05:00 vuln.today

CVE Published

May 01, 2026 - 04:00 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit_exercises.php. The manipulation of the argument edit_exercise results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in code-projects Gym Management System 1.0 allows authenticated high-privilege users to manipulate the edit_exercise parameter in /admin/edit_exercises.php, enabling remote database queries with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists; CVSS 4.7 reflects low real-world risk due to high-privilege requirement (PR:H), though the vulnerability remains remotely accessible without user interaction.

Technical ContextAI

The vulnerability exists in a PHP-based gym management application where the /admin/edit_exercises.php endpoint fails to properly sanitize user input in the edit_exercise parameter before incorporating it into SQL queries. This is a classic SQL injection (CWE-89) flaw where unsanitized input flows directly into database commands. The CPE cpe:2.3:a:code-projects:gym_management_system:*:*:*:*:*:*:*:* indicates the entire product line version 1.0 and potentially beyond are affected. The vulnerability requires administrative-level privileges (PR:H in CVSS vector), meaning the attacker must already possess a high-privilege account within the application.

RemediationAI

The primary remediation is to apply a vendor-released patch or upgrade to a patched version of Gym Management System if available; contact code-projects.org or check VulDB (https://vuldb.com/vuln/360361) for patch availability and recommended version. Until a patch is deployed, restrict administrative access to the /admin/edit_exercises.php endpoint using web application firewall (WAF) rules that block requests containing SQL metacharacters (semicolons, quotes, parentheses, keywords like 'UNION', 'SELECT', 'DROP') in the edit_exercise parameter. Implement prepared statements or parameterized queries in the affected PHP code to prevent SQL injection at the application layer-replace all direct string concatenation in SQL queries with parameterized placeholders (e.g., mysqli prepared statements or PDO with bound parameters). Additionally, audit all admin user accounts and revoke high-privilege credentials from accounts not actively requiring them; enforce strong password policies and multi-factor authentication for admin panels to reduce the likelihood of credential compromise. Monitor database query logs for anomalous SQL patterns (e.g., UNION queries, multiple SELECTs, data exfiltration attempts) originating from the admin panel. These compensating controls introduce minimal performance overhead but require ongoing maintenance of WAF rules and log monitoring.