Is there a public PoC exploit available for CVE-2026-5560?

Yes, a public proof-of-concept exploit is available for CVE-2026-5560. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5560

Q: What is the CVSS score of CVE-2026-5560?

CVE-2026-5560 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19067 LOW

SQL Injection (CWE-89)

2026-04-05 VulDB

PHP SQLi Online Shopping Portal Project Phpgurukul

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 10:45 euvd

EUVD-2026-19067

Analysis Generated

Apr 05, 2026 - 10:45 vuln.today

CVE Published

Apr 05, 2026 - 10:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /payment-method.php of the component Parameter Handler. Performing a manipulation of the argument paymethod results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to manipulate the paymethod parameter in /payment-method.php, enabling database query execution with limited confidentiality, integrity, and availability impact. The vulnerability is publicly documented with exploit code available, presenting moderate real-world risk despite the CVSS 6.3 score, as exploitation requires valid authentication credentials.

Technical ContextAI

The vulnerability exists in the parameter handling logic of the /payment-method.php file within PHPGurukul's Online Shopping Portal Project. The paymethod parameter is processed without adequate input validation or prepared statement usage, allowing an authenticated attacker to inject arbitrary SQL commands. This is a classic CWE-89 SQL injection flaw where user-supplied input is directly concatenated into SQL queries. The PHP-based e-commerce application lacks parameterized queries or robust escaping mechanisms at this specific input point, creating an entry vector for database-level attacks.

RemediationAI

Apply the latest security patch released by PHPGurukul for Online Shopping Portal Project. Developers should immediately implement parameterized prepared statements for all database queries in the /payment-method.php file and throughout the application, ensuring the paymethod parameter and all user inputs are processed via parameterized queries rather than string concatenation. Additionally, implement input validation to restrict paymethod values to expected payment method identifiers, and enforce Web Application Firewall (WAF) rules to detect and block SQL injection patterns. Comprehensive security code review of other parameter handlers is recommended to identify and remediate similar vulnerabilities. Consult https://vuldb.com/vuln/355330 for additional remediation guidance and exploit analysis.