Is there a public PoC exploit available for CVE-2026-5558?

Yes, a public proof-of-concept exploit is available for CVE-2026-5558. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5558

Q: What is the CVSS score of CVE-2026-5558?

CVE-2026-5558 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19063 LOW

SQL Injection (CWE-89)

2026-04-05 VulDB

PHP SQLi Phpgurukul Online Shopping Portal Project Phpgurukul

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 10:15 euvd

EUVD-2026-19063

Analysis Generated

Apr 05, 2026 - 10:15 vuln.today

CVE Published

Apr 05, 2026 - 10:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in PHPGurukul PHPGurukul Online Shopping Portal Project up to 2.1. Impacted is an unknown function of the file /pending-orders.php of the component Parameter Handler. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in PHPGurukul Online Shopping Portal Project up to version 2.1 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /pending-orders.php, potentially leading to unauthorized data access or modification. The vulnerability has a published proof-of-concept exploit available and carries a CVSS score of 5.3 with moderate real-world impact due to authentication requirements.

Technical ContextAI

The vulnerability exists in the Parameter Handler component of PHPGurukul Online Shopping Portal Project, specifically within the /pending-orders.php file where user-supplied input via the ID parameter is not properly sanitized before being incorporated into SQL queries. This is a classic SQL injection flaw (CWE-89) where an authenticated user can craft malicious SQL syntax in the ID parameter to manipulate database queries. The application is built in PHP and processes the parameter without parameterized queries or input validation, allowing an attacker to break out of the intended SQL context and inject arbitrary SQL commands. The vulnerability affects all versions of the product up to and including version 2.1.

RemediationAI

Organizations should immediately upgrade to a version of PHPGurukul Online Shopping Portal Project newer than 2.1 once available from the vendor. In the interim, restrict access to the /pending-orders.php file to trusted users only and implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter. Additionally, implement input validation and parameterized queries (prepared statements) at the application level to prevent SQL injection. Review database user permissions to ensure application credentials have minimal necessary privileges. For detailed remediation guidance and patch availability, check the official PHPGurukul website at https://phpgurukul.com/ and monitor the VulDB entry at https://vuldb.com/vuln/355328 for vendor updates.