Is there a public PoC exploit available for CVE-2026-19021?

Yes, a public proof-of-concept exploit is available for CVE-2026-19021. Prioritise patching immediately. EPSS: 0.3%.

Computer Repair Shop Management System CVE-2026-19021

Q: What is the CVSS score of CVE-2026-19021?

CVE-2026-19021 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-53825 MEDIUM

SQL Injection (CWE-89)

2026-08-06 VulDB

GHSA-wjcq-wr5r-854c

PHP SQLi Computer Repair Shop Management System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible endpoint requiring no authentication (AV:N, PR:N, AC:L); limited database read/write/delete impact with no scope change justifies C:L/I:L/A:L and S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 08:37 vuln.today

CVSS changed

Aug 06, 2026 - 08:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Aug 06, 2026 - 08:00 cve.org

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Computer Repair Shop Management System 1.0 exposes the /classes/Master.php?f=delete_product endpoint to unauthenticated remote attackers who can manipulate the id parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit has been disclosed on GitHub. Impact is assessed as limited (VC:L/VI:L/VA:L) with no scope change to subsequent systems, though the availability of exploit code meaningfully lowers the bar for opportunistic abuse of any internet-exposed instance.

Technical ContextAI

The affected component is a PHP class file (Master.php) that handles backend product management operations for SourceCodester's Computer Repair Shop Management System, identified by CPE cpe:2.3:a:sourcecodester:computer_repair_shop_management_system:*:*:*:*:*:*:*:*. The f=delete_product function receives an id parameter that is directly interpolated into a SQL DELETE or SELECT query without parameterization or sanitization, constituting CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). SourceCodester distributes PHP-based management system source code primarily targeting small businesses; these applications typically use MySQL or MariaDB and lack modern security frameworks that would enforce prepared statements by default. The wildcard CPE version field suggests the vulnerability may not be version-bounded beyond the 1.0 release named in the description.

RemediationAI

No vendor-released patch has been identified at time of analysis; the fix version is not independently confirmed from the available references. Organizations running this software should remediate at the code level by replacing direct SQL string concatenation in the delete_product function of /classes/Master.php with parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), which eliminates the injection vector entirely. As an immediate compensating control, deploy a web application firewall rule to block SQL metacharacters (single quotes, UNION, comment sequences) in the id parameter - note this can be bypassed by skilled attackers and is not a substitute for code-level fixes. Additionally, restrict the application to authenticated sessions only if the delete endpoint is currently unauthenticated, and apply least-privilege database account permissions so the application account cannot read sensitive tables or perform DDL operations. The SourceCodester platform (sourcecodester.com) and VulDB advisory (https://vuldb.com/vuln/386421) should be monitored for any official patch release.