Is there a public PoC exploit available for CVE-2026-19923?

Yes, a public proof-of-concept exploit is available for CVE-2026-19923. Prioritise patching immediately. EPSS: 0.2%.

Online Shopping System CVE-2026-19923

Q: What is the CVSS score of CVE-2026-19923?

CVE-2026-19923 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-59834 LOW

SQL Injection (CWE-89)

2026-08-16 VulDB

GHSA-39c6-m2p4-vg3h

PHP SQLi Online Shopping System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requiring low-privilege authentication; partial C/I/A impact with no scope change aligns with PR:L and S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 16, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

Aug 16, 2026 - 01:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 16, 2026 - 01:13 vuln.today

CVE Published

Aug 16, 2026 - 00:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkout_process.php. Executing a manipulation of the argument total_count can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the total_count parameter in /checkout_process.php to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.

Technical ContextAI

The affected product is a PHP-based e-commerce application (CPE: cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*) developed by code-projects and marketed as a demonstration or educational PHP shopping system. The root cause is CWE-89 (Improper Neutralization of Special Elements in an SQL Command): the total_count parameter submitted to /checkout_process.php is concatenated into a database query without parameterization or adequate sanitization. PHP applications of this class commonly use mysqli or PDO without prepared statements, making direct parameter injection viable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the flaw is network-reachable with low complexity and no special attack configuration required beyond a low-privilege session.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix is to refactor /checkout_process.php to use parameterized queries or prepared statements (via PHP's PDO or MySQLi) for all SQL interactions involving the total_count parameter, eliminating the injection vector without operational trade-offs. Additionally, enforce strict server-side input validation to reject non-integer or out-of-range values for total_count before any database interaction. As a compensating control, deploying a Web Application Firewall with SQL injection rule sets can filter known payloads, though WAF bypass is possible for determined attackers and should not substitute for code-level remediation. Database account privileges for this application should be scoped to minimum necessary permissions (SELECT/INSERT only, no DROP/ALTER) to limit the impact of any successful injection. Restrict checkout endpoints to authenticated sessions if not already enforced. Consult the VulDB advisory at https://vuldb.com/vuln/390173 and the public POC at https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul5.md to understand the exact payload surface.