Is there a public PoC exploit available for CVE-2026-13569?

Yes, a public proof-of-concept exploit is available for CVE-2026-13569. Prioritise patching immediately. EPSS: 0.2%.

EyouCMS CVE-2026-13569

Q: What is the CVSS score of CVE-2026-13569?

CVE-2026-13569 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40089 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-m3g7-gjrj-m254

PHP SQLi Eyoucms

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network-delivered SQL injection requires high-privilege authentication (PR:H); limited impact metrics (C:L/I:L/A:L) reflect partial database exposure rather than full compromise.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:28 vuln.today

Severity Changed

Jun 29, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 14:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in weng-xianhu EyouCMS up to 1.7.1. This issue affects some unknown processing of the file /index.php of the component API. Such manipulation of the argument click_like leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in EyouCMS up to version 1.7.1 allows remote authenticated attackers with high privileges to manipulate database queries via the click_like argument in the /index.php API component. The CVSS 4.0 score is 2.0, heavily discounted by the PR:H requirement, yet confidentiality, integrity, and availability impacts are all rated Low. A public proof-of-concept exists via a GitHub issue report; the vendor has not acknowledged or patched the vulnerability. No active exploitation has been confirmed (not listed in CISA KEV).

Technical ContextAI

EyouCMS is an open-source PHP-based content management system maintained by weng-xianhu on GitHub (cpe:2.3:a:weng-xianhu:eyoucms:*:*:*:*:*:*:*:*). The affected code path is the /index.php API endpoint, where the click_like parameter - likely associated with a content 'like' or engagement-tracking feature - is passed unsanitized into a database query. CWE-89 (Improper Neutralization of Special Elements used in SQL Command) is the root cause class, indicating the application fails to parameterize or properly escape user-supplied input before it reaches the SQL layer. Given the PHP stack and the nature of the parameter, this is characteristic of direct variable interpolation into a query string, a classic and preventable pattern.

RemediationAI

No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the responsible disclosure submitted via GitHub issue. As a primary compensating control, deploy a web application firewall (WAF) rule to block SQL metacharacters and injection patterns on the click_like parameter at the /index.php endpoint - this is effective but may cause false positives if the parameter accepts rich text. Restricting API access to trusted IP ranges or authenticated sessions with minimal necessary privilege will reduce exposure. Review and harden the PHP codebase to use prepared statements or parameterized queries (PDO or MySQLi with bound parameters) for all user-supplied input - this is the definitive fix class. Monitor https://github.com/weng-xianhu/eyoucms/ and https://vuldb.com/cve/CVE-2026-13569 for any future patch release.