Is there a public PoC exploit available for CVE-2026-10877?

Yes, a public proof-of-concept exploit is available for CVE-2026-10877. Prioritise patching immediately. EPSS: 0.0%.

Ship Ferry Ticket Reservation System CVE-2026-10877

Q: What is the CVSS score of CVE-2026-10877?

CVE-2026-10877 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34773 MEDIUM

SQL Injection (CWE-89)

2026-06-04 VulDB

GHSA-gmh5-xvqf-mwv3

PHP SQLi Ship Ferry Ticket Reservation System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 00:32 vuln.today

Severity Changed

Jun 05, 2026 - 00:22 NVD

HIGH MEDIUM

CVSS changed

Jun 05, 2026 - 00:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up to 1.0. This impacts an unknown function of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Ship Ferry Ticket Reservation System 1.0 exposes the admin login panel to unauthenticated remote attackers via a crafted Username parameter in /admin/login.php, enabling authentication bypass and backend database manipulation. Publicly available exploit code (POC) has been published on Medium demonstrating the authentication bypass technique, elevating real-world risk despite the moderate CVSS 4.0 score of 5.5. No KEV listing at time of analysis, but the zero-prerequisite network attack vector combined with a public POC makes this a credible threat to any internet-facing deployment.

Technical ContextAI

The affected product is a PHP-based web application (CPE: cpe:2.3:a:sourcecodester:ship_ferry_ticket_reservation_system:*:*:*:*:*:*:*:*) distributed by SourceCodester, a platform known for distributing open-source academic PHP projects often deployed without hardening. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: user-supplied input from the Username field in the admin login form is interpolated directly into a SQL query without parameterization or sanitization. This classic unsanitized input pattern allows an attacker to inject arbitrary SQL syntax, manipulating the authentication query logic (e.g., tautology-based bypass using payloads like ' OR '1'='1'--) to return a truthy result without valid credentials. The vulnerability resides specifically in /admin/login.php, the administrative authentication endpoint.

RemediationAI

No vendor-released patch has been identified at time of analysis - the absence of a patched version in NVD CPE or any vendor advisory in the provided references means no confirmed fix version can be cited. Organizations running this software should immediately apply the following compensating controls: rewrite database queries in /admin/login.php to use parameterized queries or prepared statements (PDO or MySQLi with bound parameters), which eliminates the injection surface at the code level. If code modification is not immediately possible, restrict network access to /admin/login.php via web server configuration (e.g., Apache .htaccess or nginx location block) to allow only trusted IP ranges, reducing the attack surface from internet-facing to internal-only - note this does not fix the vulnerability but significantly limits exposure. Deploy a Web Application Firewall (WAF) rule to detect and block common SQL injection patterns in login form parameters as an additional layer. Reference: VulDB entry at https://vuldb.com/vuln/368367 and the exploit demonstration at https://medium.com/@hemantrajbhati5555/sql-injection-in-authentication-mechanism-leads-to-authentication-bypass-65177ce7a41c for understanding the attack surface.