Is there a public PoC exploit available for CVE-2026-10235?

Yes, a public proof-of-concept exploit is available for CVE-2026-10235. Prioritise patching immediately. EPSS: 0.0%.

Ingredients Stock Management System CVE-2026-10235

Q: What is the CVSS score of CVE-2026-10235?

CVE-2026-10235 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33570 LOW

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-3wx5-jqq8-r5f9

PHP SQLi Ingredients Stock Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 08:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 08:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 07:50 vuln.today

DescriptionCVE.org

A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of the file /Ingredients-Stock/stock_manager.php. This manipulation of the argument txt_search_category causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in CodeAstro Ingredients Stock Management System 1.0 exposes authenticated remote attackers a direct path to database manipulation through the unsanitized txt_search_category parameter in /Ingredients-Stock/stock_manager.php. The CVSS vector (PR:L) confirms that low-privilege authentication is required, partially limiting exposure, but a publicly available proof-of-concept on GitHub significantly lowers the exploitation barrier. No confirmed active exploitation (CISA KEV) has been reported; however, the combination of low complexity, network accessibility, and public exploit code makes this a realistic threat against any internet-facing deployment where attacker credential acquisition is feasible.

Technical ContextAI

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input from the txt_search_category search parameter is concatenated directly into backend SQL queries without parameterization or proper escaping. The affected component is a PHP script at /Ingredients-Stock/stock_manager.php within CodeAstro's Ingredients Stock Management System, a PHP-based inventory application identified by CPE cpe:2.3:a:codeastro:ingredients_stock_management_system:*:*:*:*:*:*:*:*. The wildcard version field in the CPE suggests all current versions share the same vulnerable codebase pattern. Classic PHP SQL injection of this class typically arises from direct interpolation of $_GET or $_POST variables into query strings rather than use of prepared statements or PDO parameterized queries.

RemediationAI

No vendor-released patch has been identified at time of analysis; the VulDB submission at https://vuldb.com/submit/823086 and vendor site https://codeastro.com/ should be monitored for updates. The definitive fix requires replacing direct string interpolation in stock_manager.php with parameterized prepared statements (e.g., PHP PDO or MySQLi prepared statements) for all query parameters including txt_search_category. As compensating controls prior to a patch: deploy a web application firewall rule targeting SQL injection patterns on the txt_search_category POST/GET parameter - note this may cause false positives on legitimate search terms containing SQL-like characters. Additionally, enforce least-privilege database permissions for the application's DB user, restricting it to only the tables it needs and removing DDL or file-read privileges (e.g., LOAD_FILE, INTO OUTFILE), which limits post-exploitation data exfiltration and persistence options. Restrict application access to internal networks or VPN if the stock management system does not require internet exposure.