Is there a public PoC exploit available for CVE-2026-5640?

Yes, a public proof-of-concept exploit is available for CVE-2026-5640. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5640

Q: What is the CVSS score of CVE-2026-5640?

CVE-2026-5640 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19209 LOW

SQL Injection (CWE-89)

2026-04-06 VulDB

GHSA-9wvf-7g57-m92f

PHP SQLi Online Shopping Portal Project Phpgurukul

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 09:15 euvd

EUVD-2026-19209

Analysis Generated

Apr 06, 2026 - 09:15 vuln.today

CVE Published

Apr 06, 2026 - 09:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.php of the component Parameter Handler. The manipulation of the argument filename leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to execute arbitrary SQL queries via the filename parameter in /admin/update-image2.php. The vulnerability affects the parameter handling mechanism and has publicly available exploit code; attackers with administrative credentials can manipulate the filename argument to inject SQL commands, potentially leading to data exfiltration or modification with limited direct impact to confidentiality and integrity of the application layer.

Technical ContextAI

The vulnerability exists in the Parameter Handler component of PHPGurukul Online Shopping Portal, specifically within the /admin/update-image2.php file. CWE-89 (SQL Injection) indicates that user-supplied input from the filename parameter is not properly sanitized or parameterized before being used in SQL queries. This is a classic injection flaw where an attacker can craft malicious SQL syntax within the filename argument to alter query logic. The application fails to use prepared statements or input validation, allowing SQL metacharacters to be interpreted as commands rather than data.

RemediationAI

Developers should immediately upgrade to a patched version of PHPGurukul Online Shopping Portal if available from https://phpgurukul.com/. Interim mitigation includes: (1) apply input validation and sanitization to the filename parameter to reject SQL special characters or use a whitelist of allowed characters; (2) convert all SQL queries to use prepared statements with parameterized queries to prevent injection; (3) restrict access to /admin/update-image2.php via network segmentation or Web Application Firewall rules; (4) audit logs for suspicious SQL patterns in the filename parameter and review recent admin actions for unauthorized data access. Patch availability and exact fix version details should be obtained directly from PHPGurukul vendor communications.