Is there a public PoC exploit available for CVE-2026-5635?

Yes, a public proof-of-concept exploit is available for CVE-2026-5635. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5635

Q: What is the CVSS score of CVE-2026-5635?

CVE-2026-5635 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19193 LOW

SQL Injection (CWE-89)

2026-04-06 VulDB

GHSA-3f67-8v72-vm9p

PHP SQLi Online Shopping Portal Project Phpgurukul

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 08:15 euvd

EUVD-2026-19193

Analysis Generated

Apr 06, 2026 - 08:15 vuln.today

CVE Published

Apr 06, 2026 - 07:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categorywise-products.php of the component Parameter Handler. The manipulation of the argument cid results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to execute arbitrary SQL commands via the cid parameter in /categorywise-products.php. Publicly available exploit code exists for this vulnerability, which affects the parameter handler component. The attack requires valid user credentials but carries low impact, affecting confidentiality, integrity, and availability of data at limited scope.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in PHP application code. The /categorywise-products.php file improperly handles the cid (category ID) parameter without adequate input validation or prepared statements, allowing attackers to inject malicious SQL syntax. The affected product is PHPGurukul Online Shopping Portal Project (CPE: cpe:2.3:a:phpgurukul:online_shopping_portal_project), an open-source e-commerce platform written in PHP. The parameter handler component fails to sanitize user-supplied input before incorporating it into SQL queries, a foundational web application security weakness. This is a typical unsafe string concatenation scenario rather than parameterized query use.

RemediationAI

Immediately patch the /categorywise-products.php file to use parameterized queries or prepared statements for the cid parameter instead of direct string concatenation. Contact PHPGurukul directly through https://phpgurukul.com/ to obtain the patched version; if no official patch is available, apply input validation using whitelisting for the cid parameter (ensure it matches expected integer format) as an interim measure. For authenticated deployments, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the cid parameter. Code review of other parameter handlers in the application is recommended to identify similar injection points.