What is the CVSS score of CVE-2026-38939?

CVE-2026-38939 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

andrewtch88 mvc-ecommerce CVE-2026-38939

EUVD-2026-26387 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-30 mitre

RCE PHP XSS N A

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 18:22 vuln.today

CVSS changed

Apr 30, 2026 - 18:22 NVD

6.1 (MEDIUM)

EUVD ID Assigned

Apr 30, 2026 - 15:45 euvd

EUVD-2026-26387

Analysis Generated

Apr 30, 2026 - 15:45 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

Cross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the product_catalogue.php component

AnalysisAI

Cross-site scripting (XSS) vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows remote attackers to execute arbitrary JavaScript in victim browsers and exfiltrate sensitive information through the product_catalogue.php component. The vulnerability requires user interaction (clicking a malicious link or visiting a compromised page) but affects all users due to stored or reflected XSS impact across site sessions. CVSS 6.1 reflects moderate risk with network-based attack vector and low complexity, though no active exploitation in CISA KEV has been confirmed at time of analysis.

Technical ContextAI

The vulnerability is a reflected or stored cross-site scripting (CWE-79) flaw in PHP-based e-commerce application logic. The product_catalogue.php component fails to properly sanitize or encode user-supplied input before rendering it in HTML context, allowing attackers to inject malicious JavaScript payloads. The affected product is andrewtch88's MVC (Model-View-Controller) e-commerce framework version 1.0, which appears to be a custom or lesser-known PHP e-commerce solution. CPE data is incomplete (marked as n/a), limiting precise software supply chain tracking, but the vulnerability is documented under ENISA EUVD-2026-26387.

RemediationAI

No vendor-released patch has been identified at time of analysis. The application's vendor (andrewtch88) should immediately implement input validation and output encoding in the product_catalogue.php component, specifically using PHP's htmlspecialchars() or equivalent context-aware encoding for all user-controlled data rendered in HTML contexts. As an immediate compensating control, disable or restrict access to product_catalogue.php via web application firewall (WAF) rules that block known XSS payloads (e.g., script tags, event handlers) until patches are available. Alternatively, if the e-commerce platform is not actively maintained, consider migrating to a supported, actively maintained e-commerce framework (Magento, WooCommerce, Shopify) that receives regular security updates. Each workaround trades functionality (blocked features or reduced usability) against security; migration eliminates long-term risk but requires development effort.