Is there a public PoC exploit available for CVE-2026-5328?

Yes, a public proof-of-concept exploit is available for CVE-2026-5328. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-5328?

Yes, a patch is available for CVE-2026-5328. Update the affected software to the latest version immediately.

Java CVE-2026-5328

Q: What is the CVSS score of CVE-2026-5328?

CVE-2026-5328 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18214 LOW

SQL Injection (CWE-89)

2026-04-02 VulDB

GHSA-m5wx-cg9x-mxf5

Java SQLi Modulithshop

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 12:45 euvd

EUVD-2026-18214

Analysis Generated

Apr 02, 2026 - 12:45 vuln.today

Patch released

Apr 02, 2026 - 12:45 nvd

Patch available

CVE Published

Apr 02, 2026 - 12:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the file src/main/java/com/suisung/shopsuite/pt/service/impl/ProductIndexServiceImpl.java of the component ProductItemDao Interface. Executing a manipulation of the argument sidx/sort can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This patch is called 42bcb9463425d1be906c3b290cf29885eb5a2324. A patch should be applied to remediate this issue.

AnalysisAI

SQL injection in shsuishang modulithshop allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the sidx/sort parameter in the ProductItemDao Interface listItem function, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability affects the rolling-release product across an unspecified version range; publicly available exploit code exists. CVSS 6.3 with exploitation probability noted (E:P), and a patch is available via upstream commit 42bcb9463425d1be906c3b290cf29885eb5a2324.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in a Java-based e-commerce application. The ProductIndexServiceImpl.java file's listItem function in the ProductItemDao interface fails to properly sanitize or parameterize the sidx/sort argument before incorporating it into SQL queries. This allows an authenticated attacker to inject malicious SQL syntax through an HTTP parameter, potentially executing arbitrary database commands. The product uses a rolling release model, meaning version tags are not formally tracked, which complicates vulnerability tracking and patch identification. The affected CPE range (cpe:2.3:a:shsuishang:modulithshop:*:*:*:*:*:*:*:*) indicates all versions of modulithshop are potentially affected until the specific commit is applied.

RemediationAI

Vendor-released patch: Apply commit 42bcb9463425d1be906c3b290cf29885eb5a2324 to remediate this SQL injection vulnerability. Organizations using modulithshop should update to the latest version incorporating this commit immediately via https://github.com/shsuishang/modulithshop/commit/42bcb9463425d1be906c3b290cf29885eb5a2324. No workarounds are mentioned in available data; patching is the primary recommended remediation. In the interim, restrict access to the ProductItemDao listItem function to trusted users only and implement database-level access controls limiting query execution privileges. Consult the VulDB advisory at https://vuldb.com/vuln/354659 for additional context.