Is there a public PoC exploit available for CVE-2026-11495?

Yes, a public proof-of-concept exploit is available for CVE-2026-11495. Prioritise patching immediately. EPSS: 0.0%.

Ingredients Stock Management System CVE-2026-11495

Q: What is the CVSS score of CVE-2026-11495?

CVE-2026-11495 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35026 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-c2x4-3659-mm9x

PHP SQLi Ingredients Stock Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 07:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 08, 2026 - 06:50 vuln.today

DescriptionCVE.org

A vulnerability was detected in CodeAstro Ingredients Stock Management System 1.0. This impacts an unknown function of the file /Ingredients-Stock/add_stock.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in CodeAstro Ingredients Stock Management System 1.0 exposes the /Ingredients-Stock/add_stock.php endpoint to authenticated remote attackers who can manipulate the ID parameter to execute arbitrary SQL commands against the backend database. The attack is network-accessible with low complexity, enabling unauthorized data exfiltration, record manipulation, and potential escalation within the database tier. Publicly available exploit code exists (E:P in CVSS temporal vector), materially lowering the barrier to exploitation; no CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CodeAstro Ingredients Stock Management System is a PHP-based web application for inventory tracking. The vulnerable component is the stock addition handler at /Ingredients-Stock/add_stock.php, where the ID parameter is interpolated into a SQL query without adequate sanitization or parameterization, satisfying CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CPE string cpe:2.3:a:codeastro:ingredients_stock_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected version range beyond the 1.0 release cited in the description. The CVSS temporal modifier E:P (Proof-of-Concept exploit) and RC:R (Reasonable confidence in existence) are consistent with the VulDB report and the public GitHub proof-of-concept.

RemediationAI

No vendor-released patch or fixed version has been identified in the available data - the CPE wildcard and absence of a patch reference in VulDB suggest no upstream fix has been published as of this analysis. Immediate compensating controls should include replacing any direct SQL string concatenation involving the ID parameter with prepared statements and parameterized queries, which eliminates the injection surface entirely. Additionally, deploy a web application firewall (WAF) rule to detect and block SQL metacharacter sequences in the ID parameter for the /Ingredients-Stock/add_stock.php route; note this is a detection layer and not a code-level fix. Restrict access to the add_stock endpoint to authenticated internal network users only, reducing exposure from internet-facing deployments. Rotate all database credentials associated with this application as a precaution if exploitation cannot be ruled out. Monitor vendor advisory at https://codeastro.com/ and the VulDB entry https://vuldb.com/vuln/369115 for patch availability.