Is there a public PoC exploit available for CVE-2026-5583?

Yes, a public proof-of-concept exploit is available for CVE-2026-5583. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5583

Q: What is the CVSS score of CVE-2026-5583?

CVE-2026-5583 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19111 LOW

SQL Injection (CWE-89)

2026-04-05 VulDB

PHP SQLi Online Shopping Portal Project Phpgurukul

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 17:00 euvd

EUVD-2026-19111

Analysis Generated

Apr 05, 2026 - 17:00 vuln.today

CVE Published

Apr 05, 2026 - 16:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A security vulnerability has been detected in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /my-profile.php of the component Parameter Handler. The manipulation of the argument fullname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the fullname parameter in /my-profile.php. The vulnerability has a publicly disclosed exploit and CVSS 5.3 score reflecting low confidentiality and integrity impact; however, the moderate real-world risk is elevated by public exploit availability and the authentication-required nature suggesting insider or credential-based attack scenarios.

Technical ContextAI

The vulnerability exists in the Parameter Handler component of /my-profile.php, where user-supplied input from the fullname parameter is processed without proper sanitization or parameterized query protection before being used in SQL statements. This represents a classic SQL injection flaw (CWE-89) where attackers can inject arbitrary SQL syntax to manipulate database queries. The affected product is PHPGurukul Online Shopping Portal Project, a PHP-based e-commerce platform (CPE: cpe:2.3:a:phpgurukul:online_shopping_portal_project:*:*:*:*:*:*:*:*), which is commonly deployed in educational and small-business contexts. The remotely accessible /my-profile.php endpoint processes profile update requests, making it a natural attack surface for SQL injection exploitation.

RemediationAI

Patch availability and specific fixed versions are not confirmed from the provided data; consult the PHPGurukul project repository and phpgurukul.com for available security updates or upgrade guidance. Immediate workarounds include implementing input validation and parameterized prepared statements for all database queries in /my-profile.php, particularly the fullname parameter handler; restrict database user permissions to principle of least privilege (execute only necessary stored procedures, no direct table modification); and apply Web Application Firewall (WAF) rules to block SQL injection syntax in the fullname parameter. Organizations should verify their deployed version against the latest PHPGurukul releases and security advisories at https://phpgurukul.com/ and monitor the VulDB reference (https://vuldb.com/vuln/355380) for patch announcements.