Is there a public PoC exploit available for CVE-2026-15703?

Yes, a public proof-of-concept exploit is available for CVE-2026-15703. Prioritise patching immediately. EPSS: 0.3%.

Shopping Cart Script CVE-2026-15703

Q: What is the CVSS score of CVE-2026-15703?

CVE-2026-15703 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43961 MEDIUM

SQL Injection (CWE-89)

2026-07-14 VulDB

GHSA-mhh3-g489-6fpv

PHP SQLi Simple And Nice Shopping Cart Script Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable with no complexity or interaction needed; PR:N per VulDB assessment though admin-path location introduces unresolved authentication uncertainty; partial CIA impact with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:04 vuln.today

CVSS changed

Jul 14, 2026 - 17:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 14, 2026 - 17:00 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables remote attackers to manipulate backend database queries via the unsanitized user_id parameter in /admin/userproductdeletequery.php. A publicly available proof-of-concept exploit exists on GitHub, and SSVC confirms the attack is automatable with partial impact across confidentiality, integrity, and availability. Despite the public POC, EPSS stands at only 0.33% (25th percentile), reflecting the product's negligible enterprise deployment footprint rather than a benign technical profile.

Technical ContextAI

The affected product is a PHP-based shopping cart web application distributed by SourceCodester, identified by CPE cpe:2.3:a:sourcecodester:simple_and_nice_shopping_cart_script:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controlled input via the user_id request parameter is incorporated directly into a SQL query within /admin/userproductdeletequery.php without parameterization or adequate sanitization, allowing an attacker to alter the intended query logic. This is a well-understood class of injection flaw in PHP applications that lack prepared statement usage, and the pattern is straightforward to exploit with standard SQLi tooling.

RemediationAI

No vendor-released patch or fixed version has been identified in the available data at time of analysis. The definitive fix is to refactor /admin/userproductdeletequery.php to replace the vulnerable query construction with parameterized queries or prepared statements for the user_id input, eliminating the injection vector at the code level. As a compensating control pending a code fix, restrict access to the /admin/ directory via web server configuration - for example, using IP allowlisting or HTTP Basic Authentication enforced at the server layer (Apache .htaccess or nginx auth_basic) - to reduce the exposed attack surface; note this does not remediate the underlying flaw and is bypassable if the allowlist is misconfigured. Deploying a WAF with SQL injection detection signatures (e.g., ModSecurity with the OWASP CRS ruleset) can provide detection and partial blocking, but WAF rules can be evaded by obfuscated payloads. Monitor VulDB advisory https://vuldb.com/vuln/378250 and https://www.sourcecodester.com/ for any patch releases.