Is there a public PoC exploit available for EUVD-2026-28484?

Yes, a public proof-of-concept exploit is available for EUVD-2026-28484. Prioritise patching immediately. EPSS: 0.0%.

Simple Chat System EUVD-2026-28484

Q: What is the CVSS score of EUVD-2026-28484?

EUVD-2026-28484 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8125 LOW

SQL Injection (CWE-89)

2026-05-08 VulDB

GHSA-pj2x-r6wc-476j

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 08, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

May 08, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 08, 2026 - 02:15 vuln.today

CVE Published

May 08, 2026 - 01:30 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was detected in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the file sendMessage.php. The manipulation of the argument type/length/business parameter validity results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Simple Chat System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the type, length, or business parameters in sendMessage.php, potentially compromising data confidentiality, integrity, and availability. Publicly available exploit code exists and the vulnerability carries a CVSS score of 6.3 with authenticated network access.

Technical ContextAI

The vulnerability resides in sendMessage.php, a PHP file responsible for handling message transmission in the Simple Chat System application. The root cause is CWE-89 (SQL Injection), indicating insufficient input validation or sanitization of user-supplied parameters (specifically type, length, and business arguments) before incorporation into SQL queries. The lack of parameterized queries or prepared statements allows attackers to inject arbitrary SQL commands. As a web application vulnerability affecting a PHP-based chat system, this represents a classic server-side injection flaw where untrusted user input flows directly into database query construction without proper escaping or type checking.

RemediationAI

The primary remediation is to upgrade to a patched version of Simple Chat System if available from https://code-projects.org/; however, no vendor-released patch version has been independently confirmed at this time. As an immediate compensating control, implement input validation and parameterized queries (prepared statements with bound parameters) in sendMessage.php to prevent SQL injection - replace all dynamic SQL construction with parameterized equivalents, validating that type, length, and business parameters conform to expected data types and whitelist acceptable values. Additionally, apply the principle of least privilege by restricting database user permissions to only those operations required for normal chat functionality (e.g., SELECT and INSERT on specific tables, no DROP or ALTER permissions). Consider temporarily disabling message functionality or restricting it to authenticated administrators until patches are applied. Web Application Firewall (WAF) rules can be configured to detect and block SQL injection patterns in these specific parameters, though this is a temporary measure and not a substitute for code-level fixes.