Is there a public PoC exploit available for CVE-2026-15190?

Yes, a public proof-of-concept exploit is available for CVE-2026-15190. Prioritise patching immediately. EPSS: 0.3%.

Shopping Cart Script CVE-2026-15190

Q: What is the CVSS score of CVE-2026-15190?

CVE-2026-15190 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42615 MEDIUM

SQL Injection (CWE-89)

2026-07-09 VulDB

GHSA-486j-3xr5-53qr

PHP SQLi Simple And Nice Shopping Cart Script Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated login form with no user interaction; limited C/I/A impact consistent with a single-application SQLi scope and no privilege escalation beyond app DB user.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 17:25 vuln.today

CVSS changed

Jul 09, 2026 - 17:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of the file /login.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 allows unauthenticated remote attackers to manipulate the Username parameter on /login.php, potentially bypassing authentication or extracting database contents. A publicly available proof-of-concept exploit exists, published via a GitHub issue and documented in VulDB entry 377116. No CISA KEV listing is present, but the combination of network accessibility, no authentication requirement, and a live POC makes this a practical risk for any exposed deployment.

Technical ContextAI

The affected application is a PHP-based e-commerce script distributed by SourceCodester (cpe:2.3:a:sourcecodester:simple_and_nice_shopping_cart_script:*:*:*:*:*:*:*:*). The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input - specifically the Username field submitted to /login.php - is passed directly or insufficiently sanitized into an SQL query. This is a classic unsanitized string concatenation pattern common in legacy PHP applications that do not use parameterized queries or prepared statements. The wildcard CPE version string suggests all known releases of the script may be affected, not just 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis. The most direct remediation is to replace string concatenation in the /login.php SQL query with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions - this eliminates the injection surface entirely. As a compensating control, a web application firewall (WAF) rule blocking common SQL metacharacters (single quotes, double dashes, UNION, SELECT keywords) in the Username POST parameter can reduce exploitation risk, though WAF bypass techniques exist and this is not a permanent fix. Additionally, restricting public internet access to the login endpoint via IP allowlist - if the application audience is known - eliminates the network-exposed attack surface entirely. If the application is not actively maintained, the most defensible action is to decommission or replace it. The VulDB entry at https://vuldb.com/vuln/377116 and the POC at https://github.com/zainaakinyi45-boop/cve/issues/1 should be reviewed for any updated patch information.