Computer Repair Shop CVE-2026-10263

Q: What is the CVSS score of CVE-2026-10263?

CVE-2026-10263 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33645 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 cna@vuldb.com

GHSA-j9qv-7qrv-x4g8

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:35 vuln.today

DescriptionCVE.org

A vulnerability was found in SourceCodester Computer Repair Shop Management System up to 1.0. Affected is an unknown function of the file /admin/products/manage_product.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Computer Repair Shop Management System 1.0 exposes the admin product management endpoint to unauthenticated remote attackers who can manipulate the 'ID' parameter in /admin/products/manage_product.php to execute arbitrary SQL statements. The CVSS 4.0 vector confirms no privileges or user interaction are required (PR:N, UI:N, AV:N), and a proof-of-concept exploit has been publicly disclosed (E:P), lowering the bar for exploitation. Impact is assessed as low-to-moderate across confidentiality, integrity, and availability on the vulnerable system, with no lateral scope change to subsequent systems.

Technical ContextAI

The affected application is a PHP-based web management system built on SourceCodester's platform (sourcecodester.com), targeted at small repair shop operations. The vulnerable endpoint /admin/products/manage_product.php accepts an 'ID' parameter that is passed unsanitized into a backend SQL query, consistent with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), the parent class covering SQL injection. This class of vulnerability arises when user-controlled input is concatenated directly into SQL query strings without parameterized queries or prepared statements. No CPE string was provided, but the affected version is confirmed as up to and including 1.0. The PHP tag confirms server-side scripting is the delivery mechanism.

RemediationAI

No vendor-released patch has been identified at the time of analysis - the vulnerability was reported via a GitHub issue (https://github.com/gxcyyjy/CVE/issues/4) and VulDB (https://vuldb.com/vuln/367543) without an associated upstream fix or tagged release. Developers should remediate by replacing any dynamic SQL string concatenation in manage_product.php with parameterized queries or prepared statements (e.g., PDO with bindParam), which eliminates the injection vector at the root cause. As compensating controls, restrict access to the /admin/ directory to trusted IP ranges via web server configuration (e.g., Apache 'Require ip' or nginx 'allow/deny'), which limits network-wide unauthenticated exposure at the cost of operational flexibility for remote administrators. Input validation on the ID parameter (enforce integer type) should be applied as a secondary defense but is not a substitute for parameterized queries. Web application firewall rules blocking common SQL injection patterns (OR 1=1, UNION SELECT, etc.) can reduce opportunistic exploitation but are bypassable by determined attackers.