Is there a public PoC exploit available for CVE-2026-15540?

Yes, a public proof-of-concept exploit is available for CVE-2026-15540. Prioritise patching immediately. EPSS: 0.2%.

Online Book Store System CVE-2026-15540

Q: What is the CVSS score of CVE-2026-15540?

CVE-2026-15540 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43296 LOW

PHP Remote File Inclusion (CWE-98)

2026-07-13 VulDB

GHSA-gxqv-hc62-jvc7

PHP Information Disclosure LFI Online Book Store System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.7 LOW

Admin panel access requires high privileges (PR:H); LFI yields limited file read (C:L) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 08:23 vuln.today

Severity Changed

Jul 13, 2026 - 08:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 08:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 13, 2026 - 06:30 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/require statement in php program. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

Local File Inclusion (LFI) in SourceCodester Online Book Store System 1.0 allows authenticated remote attackers to read arbitrary files on the server by manipulating the page parameter in /admin/index.php, leading to source code and sensitive file disclosure. The vulnerability stems from unsanitized user input passed directly to PHP's include/require statement (CWE-98), with a publicly available proof-of-concept exploit documented on Medium. No patch has been identified; CVSS 4.0 scores this 2.1, reflecting the limited impact scope and authenticated precondition.

Technical ContextAI

CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes a class of PHP-specific flaws where user-supplied input is passed without sanitization to include(), require(), or their variants, enabling path traversal to load arbitrary local files. The affected component is the administrative interface at /admin/index.php in SourceCodester Online Book Store System 1.0 (CPE: cpe:2.3:a:sourcecodester:online_book_store_system:*:*:*:*:*:*:*:*). The page GET/POST parameter is used to dynamically construct the file path for inclusion, a common but dangerous PHP pattern. SourceCodester is a code-sharing platform hosting educational/hobby PHP projects; this product is not an enterprise-grade application and typically lacks hardened input validation.

RemediationAI

No vendor-released patch has been identified at time of analysis. Upstream fix availability is not confirmed - the only references are VulDB entries and a community POC writeup. Immediate compensating controls include: (1) Restricting access to /admin/index.php and the entire /admin/ directory to trusted IP ranges via web server ACLs or firewall rules - this eliminates remote exploitation but requires network-level enforcement. (2) Implementing a strict allowlist for the page parameter in application code, accepting only predefined, alphanumeric page identifiers and rejecting any input containing path traversal sequences (../, /, %2F, %2E). (3) Disabling PHP's allow_url_include directive in php.ini to block remote file inclusion variants, though this does not prevent local file inclusion. Organizations running this software in production (atypical given its hobby-project nature) should treat it as unmaintained and consider replacing it with a supported alternative.