Is there a public PoC exploit available for CVE-2026-5639?

Yes, a public proof-of-concept exploit is available for CVE-2026-5639. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5639

Q: What is the CVSS score of CVE-2026-5639?

CVE-2026-5639 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19207 LOW

SQL Injection (CWE-89)

2026-04-06 VulDB

GHSA-7p84-m28m-q2vh

PHP SQLi Online Shopping Portal Project Phpgurukul

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 09:15 euvd

EUVD-2026-19207

Analysis Generated

Apr 06, 2026 - 09:15 vuln.today

CVE Published

Apr 06, 2026 - 08:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in PHPGurukul Online Shopping Portal Project 2.1. Impacted is an unknown function of the file /admin/update-image3.php of the component Parameter Handler. Executing a manipulation of the argument filename can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to manipulate the filename parameter in /admin/update-image3.php, leading to database query manipulation with limited confidentiality and integrity impact. The vulnerability carries a CVSS score of 5.3 (medium severity) and requires valid admin credentials to exploit; publicly available exploit code exists but the vulnerability is not confirmed as actively exploited in CISA KEV.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP parameter handler (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) within the admin image update function. The filename parameter is passed directly to SQL queries without sanitization or parameterized query use, allowing attackers to inject arbitrary SQL syntax. The affected product is PHPGurukul Online Shopping Portal Project (CPE: cpe:2.3:a:phpgurukul:online_shopping_portal_project:*:*:*:*:*:*:*:*), a PHP-based e-commerce application. The file /admin/update-image3.php is part of the admin panel's image management component, suggesting database interactions for image metadata or file references.

RemediationAI

Organizations should upgrade PHPGurukul Online Shopping Portal Project to a patched version released by the vendor after coordinating with phpgurukul.com. As an interim workaround, implement strict input validation and whitelist-based filtering on the filename parameter in /admin/update-image3.php to reject SQL metacharacters, use parameterized prepared statements in all database queries, and restrict admin panel access to trusted IP ranges or require multi-factor authentication. Review database user permissions to ensure the application's database account operates under the principle of least privilege. The VulDB advisory (https://vuldb.com/vuln/355427) provides additional technical details; exploit code is documented at https://github.com/f1rstb100d/CVE/issues/17 for security testing purposes only.