What is the CVSS score of CVE-2026-30574?

CVE-2026-30574 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30574?

CVE-2026-30574 presents notable security risk rated CVSS 7.5. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for CVE-2026-30574?

Yes, a public proof-of-concept exploit is available for CVE-2026-30574. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30574?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-30574

EUVD-2026-16706 HIGH

Improper Enforcement of Behavioral Workflow (CWE-841)

2026-03-27 mitre

GHSA-3wqr-83x4-348r

PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 18:03 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 16:45 euvd

EUVD-2026-16706

Analysis Generated

Mar 27, 2026 - 16:45 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application fails to verify if the requested sales quantity (txtqty) exceeds the available stock level. An attacker can manipulate the request to purchase a quantity that is significantly higher than the actual available stock.

AnalysisAI

SourceCodester Pharmacy Product Management System 1.0 fails to enforce inventory constraints in the add-sales.php module, allowing attackers to create sales transactions for quantities that exceed available stock levels. This business logic flaw enables overselling scenarios where the system processes orders without validating stock availability, potentially leading to negative inventory records and operational disruption. Publicly available exploit code exists demonstrating the vulnerability, though no CVSS scoring or active exploitation via CISA KEV has been confirmed.

Technical ContextAI

The vulnerability exists in a PHP-based e-commerce application (SourceCodester Pharmacy Product Management System) where the add-sales.php file processes sales requests containing a quantity parameter (txtqty). The root cause is insufficient input validation and business logic enforcement-specifically, the application fails to implement server-side verification that compares the requested sales quantity against the current stock level before processing the transaction. This falls under CWE categories related to business logic flaws and insufficient input validation. The affected product is identified as a PHP application managing pharmacy inventory and sales operations, though precise CPE designation data is incomplete in available sources.

RemediationAI

The primary remediation is to implement server-side validation in the add-sales.php file that verifies the requested sales quantity (txtqty) does not exceed the current stock level before processing any transaction. This should include database-level constraints and transactional logic to atomically verify inventory and decrement stock. Contact SourceCodester for an updated version of Pharmacy Product Management System that includes this inventory validation control, or engage qualified PHP developers to patch the application code. As an interim control, implement application-level access restrictions limiting sales entry to trusted administrative users and enable detailed transaction logging to detect and audit overselling attempts. Additionally, conduct a database audit to identify any existing transactions where sales quantities exceed recorded stock levels and reconcile inventory records accordingly.