Is there a public PoC exploit available for CVE-2026-12776?

Yes, a public proof-of-concept exploit is available for CVE-2026-12776. Prioritise patching immediately. EPSS: 0.2%.

House-Rental-Management CVE-2026-12776

Q: What is the CVSS score of CVE-2026-12776?

CVE-2026-12776 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38142 LOW

SQL Injection (CWE-89)

2026-06-21 VulDB

GHSA-34wf-crw6-8386

PHP SQLi House Rental Management

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible SQLi requiring authenticated session (PR:L); no scope change; availability impact omitted as no denial-of-service mechanism is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:30 vuln.today

Severity Changed

Jun 21, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. This affects an unknown part of the file /index.php?page=houses. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Montodel House-Rental-Management exposes database contents and integrity to authenticated remote attackers via the unsanitized ID parameter at /index.php?page=houses. All tracked commits up to 90010017b81265eb1ef3810268909f7719a33863 are affected, with no patched release available as the vendor did not respond to coordinated disclosure. Publicly available exploit code exists (E:P in the CVSS 4.0 vector), lowering the bar for exploitation; however, the required authenticated context and limited per-query impact keep the overall risk score low at CVSS 4.0 2.1.

Technical ContextAI

House-Rental-Management is a PHP-based property rental application maintained under a rolling-release model, identified by CPE cpe:2.3:a:montodel:house-rental-management:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The application constructs SQL queries by concatenating the user-supplied ID parameter from a GET request to /index.php?page=houses directly into a database query without parameterization or input sanitization, a classic first-order SQL injection pattern common in legacy PHP codebases that do not leverage PDO or MySQLi prepared statements. This architecture allows an attacker to alter query logic, access unauthorized rows, or modify data depending on the database account's privileges.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to coordinated disclosure. The primary remediation is to fork the project and refactor the houses lookup query to use PDO or MySQLi prepared statements with bound parameters, eliminating the injection surface entirely. As a compensating control, deploy a Web Application Firewall (WAF) rule set targeting SQL injection patterns (e.g., ModSecurity CRS rule 942xxx) in front of the application - note this introduces false-positive risk for legitimate queries containing SQL-like strings. Additionally, restrict the database account used by the application to SELECT/INSERT/UPDATE on only necessary tables, so that even a successful injection cannot read sensitive system tables or execute stacked queries with DROP/ALTER. Finally, consider restricting access to /index.php?page=houses at the network or authentication layer to reduce the pool of potential authenticated attackers. See https://vuldb.com/vuln/372518 and the POC at https://github.com/yihaofuweng/cve/issues/68 for technical detail.