What is the CVSS score of CVE-2026-37149?

CVE-2026-37149 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Grocery Store Management System are affected by CVE-2026-37149?

A SQL injection vulnerability in the open-source Grocery Store Management System (v1.0) enables attackers to access sensitive database contents including customer records and credentials through an…

How to fix or mitigate CVE-2026-37149?

Within 24 hours: Inventory all systems running Grocery Store Management System v1.0; assess whether customer or credential data is stored in affected databases; enable Web Application Firewall (WAF) rules to block SQL injection patterns in the /grocery/search_products.php endpoint targeting the 'scost' parameter. Within 7 days: Apply input validation and parameterized query fixes if your organization maintains source code, or isolate the affected application from production networks. Within 30 days: Evaluate migration to a maintained alternative system or monitor vendor channels for security patches.

Grocery Store Management System CVE-2026-37149

HIGH

SQL Injection (CWE-89)

2026-06-25 mitre

PHP SQLi N A

7.7

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

SQLi via an HTTP-reachable, unauthenticated search parameter justifies AV:N/AC:L/PR:N/UI:N; data read and likely write give C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:23 vuln.today

CVSS changed

Jun 26, 2026 - 15:22 NVD

7.7 (HIGH)

CVE Published

Jun 25, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 25, 2026 - 00:00 cve.org

HIGH 7.7

DescriptionCVE.org

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

AnalysisAI

SQL injection in the open-source Grocery Store Management System (PHP/MySQL, v1.0 by anirudhkannanvp) lets attackers read arbitrary database contents by injecting a crafted SQL payload through the unsanitized 'scost' parameter of /grocery/search_products.php. The flaw (CWE-89) carries a CVSS of 7.7 and exposes credentials, customer records, and other sensitive data; publicly available exploit code exists in a dedicated GitHub repository, though it is not listed in CISA KEV and its EPSS exploitation probability is low (0.24%, 16th percentile).

Technical ContextAI

The affected application is a PHP web application backed by a MySQL/MariaDB database administered via phpMyAdmin, a common stack for small-business inventory demos and student projects. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'scost' request parameter is concatenated directly into a SQL query in the product-search handler (/grocery/search_products.php) without parameterization or input sanitization, allowing the query structure to be altered. Because the search interface typically issues SELECT statements, an attacker can leverage UNION-based or boolean/error-based techniques to exfiltrate data from any table the database user can reach. CPE enrichment is unavailable (the NVD CPE is the placeholder 'cpe:2.3:a:n/a:n/a:*'), so the affected component is identified only from the description and the upstream GitHub project, not from structured product metadata.

RemediationAI

No vendor-released patch identified at time of analysis - the project is an individual GitHub repository with no security advisory or tagged fix. The actionable code-level fix is to rewrite the query in /grocery/search_products.php to use parameterized queries / prepared statements (PDO or mysqli bound parameters) for the 'scost' value, and to apply server-side input validation; the OWASP guidance referenced in the CVE (https://owasp.org/www-community/attacks/SQL_Injection) describes the technique. Until the code is fixed, restrict network exposure of the application (place it behind authentication or a VPN, or remove it from internet-facing hosts), deploy a WAF rule to block SQL metacharacters on the 'scost' parameter (trade-off: regex-based WAF rules can be bypassed and may break legitimate searches containing quotes), and run the application's MySQL account with least privilege limited to the specific tables required (trade-off: does not stop disclosure of in-scope tables). Given the project's status, migrating away from this unmaintained application is the most durable remediation.