Is there a public PoC exploit available for CVE-2026-19787?

Yes, a public proof-of-concept exploit is available for CVE-2026-19787. Prioritise patching immediately. EPSS: 0.2%.

Air Cargo Management System CVE-2026-19787

Q: What is the CVSS score of CVE-2026-19787?

CVE-2026-19787 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-58572 LOW

SQL Injection (CWE-89)

2026-08-14 VulDB

GHSA-q3jq-xjh7-vvhf

SQLi PHP Air Cargo Management System

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network-reachable endpoint requires high-privilege authentication (PR:H); SQL injection yields limited read/write/availability impact on the application database only, with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:47 vuln.today

Severity Changed

Aug 14, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Aug 14, 2026 - 03:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

CVE Published

Aug 14, 2026 - 02:45 cve.org

LOW 2.0

DescriptionCVE.org

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Air Cargo Management System 1.0 exposes the /classes/Master.php?f=save_cargo_type endpoint to database manipulation via a crafted id argument. Exploitation requires high-privilege authenticated access (CVSS 4.0 PR:H), constraining the realistic attacker pool to compromised or shared administrator accounts. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid, high-privilege (administrator-level) authenticated session in the SourceCodester Air Cargo Management System 1.0, as confirmed by the CVSS 4.0 PR:H metric - unauthenticated exploitation is not possible per the provided vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 2.0 is depressed primarily by the PR:H requirement, which mandates administrator-level credentials before exploitation is possible, significantly narrowing the viable attacker population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.