Is there a public PoC exploit available for CVE-2026-19209?

Yes, a public proof-of-concept exploit is available for CVE-2026-19209. Prioritise patching immediately. EPSS: 0.2%.

Photo Share Website CVE-2026-19209

Q: What is the CVSS score of CVE-2026-19209?

CVE-2026-19209 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-54509 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-08-07 VulDB

GHSA-24ff-3qq5-28jr

PHP XSS Photo Share Website Sourcecodester

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable XSS requiring low-privilege auth (PR:L) and victim page-load (UI:R); scope change to victim browser context justifies S:C with limited C:L/I:L impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 16:30 vuln.today

Severity Changed

Aug 07, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Aug 07, 2026 - 16:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

CVE Published

Aug 07, 2026 - 15:45 cve.org

LOW 2.0

DescriptionCVE.org

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.

AnalysisAI

Stored or reflected cross-site scripting in SourceCodester Photo Share Website 1.0 enables remote authenticated attackers to inject arbitrary JavaScript via the Comment argument at /social/index.php?page=home, executing in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists on GitHub (gensnext/cve/issues/1), though the vulnerability carries a low CVSS 4.0 score of 2.0 and is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. Practical impact is limited to session hijacking, phishing redirection, or DOM manipulation within the application context of other authenticated users.

Technical ContextAI

The affected product is SourceCodester Photo Share Website 1.0, a PHP-based social photo-sharing web application (CPE: cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning the application fails to sanitize or encode user-supplied input in the Comment field before rendering it in the HTML response. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the vulnerability is network-reachable, requires a low-privilege authenticated user to submit the payload, and requires passive victim interaction for triggering - consistent with a stored or reflected XSS pattern where a second user must load the page. No server-side output encoding or Content Security Policy defense appears to be in place.

RemediationAI

No vendor-released patch has been identified at time of analysis for SourceCodester Photo Share Website. The primary recommended fix is to apply proper output encoding to all user-supplied data rendered in HTML context - specifically, PHP's htmlspecialchars() or htmlentities() functions should be applied to the Comment field value before it is written to the page response in /social/index.php. As a compensating control, operators can deploy a Web Application Firewall (WAF) rule to block common XSS payloads in the Comment parameter, though WAF bypass techniques exist and this is not a substitute for source-level fixing. Implementing a Content Security Policy (CSP) header restricting inline script execution would significantly reduce the exploitability of any remaining XSS vectors. Organizations using this application in production should evaluate whether the product can be replaced with an actively maintained alternative, given the absence of a formal security support posture from the vendor. References: VulDB entry https://vuldb.com/vuln/386954, POC https://github.com/gensnext/cve/issues/1.