Is there a public PoC exploit available for CVE-2026-5636?

Yes, a public proof-of-concept exploit is available for CVE-2026-5636. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5636

Q: What is the CVSS score of CVE-2026-5636?

CVE-2026-5636 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19192 LOW

SQL Injection (CWE-89)

2026-04-06 VulDB

GHSA-h6g8-c22x-m2px

PHP SQLi Online Shopping Portal Project Phpgurukul

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 08:15 euvd

EUVD-2026-19192

Analysis Generated

Apr 06, 2026 - 08:15 vuln.today

CVE Published

Apr 06, 2026 - 08:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /cancelorder.php of the component Parameter Handler. This manipulation of the argument oid causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to execute arbitrary SQL queries via the oid parameter in /cancelorder.php, potentially enabling unauthorized data access or modification. Publicly available exploit code exists for this vulnerability, which affects the parameter handler component and carries a CVSS score of 5.3 with confirmed exploitation feasibility.

Technical ContextAI

The vulnerability is a SQL injection flaw (CWE-89) in the Parameter Handler component of PHPGurukul Online Shopping Portal Project. The affected file /cancelorder.php fails to properly sanitize or parameterize the oid input parameter before passing it to SQL queries. This is a classic injection attack vector where user-supplied data is directly concatenated into SQL statements without proper escaping or prepared statement usage. PHPGurukul, a PHP-based e-commerce educational project, is the affected product family as identified by CPE cpe:2.3:a:phpgurukul:online_shopping_portal_project. The attack leverages improper input validation in a web-accessible endpoint.

RemediationAI

Implement parameterized SQL queries (prepared statements) for all database operations in /cancelorder.php, specifically for the oid parameter. Validate and sanitize all user inputs before use in SQL statements, ensuring only expected data types and formats are accepted. Apply the latest security updates available from PHPGurukul; however, no vendor-released patch version is confirmed in available data. For immediate mitigation, restrict access to the /cancelorder.php endpoint to trusted networks only, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the oid parameter, and audit database logs for suspicious activity. Consult the vendor advisory at https://vuldb.com/vuln/355424 for additional guidance.