Is there a public PoC exploit available for CVE-2026-19196?

Yes, a public proof-of-concept exploit is available for CVE-2026-19196. Prioritise patching immediately. EPSS: 0.3%.

Photo Share Website CVE-2026-19196

Q: What is the CVSS score of CVE-2026-19196?

CVE-2026-19196 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54369 MEDIUM

SQL Injection (CWE-89)

2026-08-07 VulDB

GHSA-92jx-33pg-rj87

PHP SQLi Photo Share Website Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable unauthenticated login endpoint with no complexity; partial C/I/A impact consistent with limited SQL query manipulation per CVSS 4.0 signal.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 07, 2026 - 06:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 07, 2026 - 06:01 vuln.today

CVE Published

Aug 07, 2026 - 05:00 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Photo Share Website 1.0 exposes the login endpoint /social/ajax.php?action=login to remote unauthenticated exploitation via the email parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector confirms zero-barrier access - no credentials, no complexity, no user interaction required against a default deployment. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the threshold for opportunistic attacks, though no active exploitation has been confirmed in CISA KEV.

Technical ContextAI

Photo Share Website 1.0 is a PHP-based open-source web application distributed by SourceCodester. The login handler at /social/ajax.php?action=login accepts a user-supplied email parameter that is incorporated into a SQL query without parameterization or sanitization, satisfying CWE-89 (Improper Neutralization of Special Elements used in SQL Command - SQL Injection). This is a textbook PHP string-concatenation SQL injection pattern, common in SourceCodester educational projects that use direct mysqli or similar calls without prepared statements. The CPE string cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:* uses a version wildcard, indicating all tracked versions are affected with no confirmed upper bound. The attack surface is the public-facing login form, requiring no session or account.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix requires refactoring the login handler in /social/ajax.php to replace string-concatenated SQL with parameterized queries or prepared statements (e.g., PHP PDO or mysqli prepare()/bind_param()) - this eliminates the injection root cause. As an immediate compensating control, administrators should restrict access to the login endpoint at the web server or firewall layer if the application is not required to be publicly accessible; this eliminates remote exploitability but also blocks legitimate users. Deploying a WAF rule to detect and block common SQL injection patterns against the email parameter provides partial mitigation with lower availability impact, though WAF rules can be bypassed by determined attackers and may cause false positives on valid email inputs containing special characters. Rate-limiting requests to /social/ajax.php?action=login limits automated scanning efficiency but does not block the attack. Monitor https://vuldb.com/vuln/386713 and https://www.sourcecodester.com/ for any upstream patch release.