Which versions of PHP are affected by CVE-2026-2165?

A high-severity vulnerability in detronetdip E-commerce 1.0.0 allows unauthorized account creation through the seller registration endpoint, potentially enabling attackers to establish fraudulent…

Is there a public PoC exploit available for CVE-2026-2165?

Yes, a public proof-of-concept exploit is available for CVE-2026-2165. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-2165?

Within 24 hours: Isolate affected e-commerce instances from production if running version 1.0.0, and implement Web Application Firewall (WAF) rules to restrict access to /Admin/assets/backend/seller/add_seller.php. Within 7 days: Conduct forensic review of account creation logs to identify suspicious seller accounts created post-disclosure, and disable the seller registration feature if operationally feasible. Within 30 days: Upgrade detronetdip to a patched version when released, or migrate to an alternative e-commerce platform with vendor security commitment.

PHP CVE-2026-2165

Q: What is the CVSS score of CVE-2026-2165?

CVE-2026-2165 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Improper Authentication (CWE-287)

2026-02-08 cna@vuldb.com

PHP Authentication Bypass E Commerce Detronetdip

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 19, 2026 - 20:17 vuln.today

Public exploit code

CVE Published

Feb 08, 2026 - 17:15 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Detronetdip E-commerce 1.0.0 contains an authentication bypass vulnerability in the seller account creation endpoint that allows unauthenticated remote attackers to manipulate the email parameter and gain unauthorized access. The vulnerability affects PHP-based e-commerce installations and has public exploit code available, though no patch is currently available from the vendor.

Technical ContextAI

Classified as CWE-287 (Improper Authentication). Affects E-Commerce. A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.