Is there a public PoC exploit available for CVE-2026-5811?

Yes, a public proof-of-concept exploit is available for CVE-2026-5811. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5811

Q: What is the CVSS score of CVE-2026-5811?

CVE-2026-5811 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20788 LOW

Business Logic Errors (CWE-840)

2026-04-08 cna@vuldb.com

GHSA-g2vp-wffw-c4mw

PHP Information Disclosure

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 08, 2026 - 23:24 euvd

EUVD-2026-20788

Analysis Generated

Apr 08, 2026 - 23:24 vuln.today

CVE Published

Apr 08, 2026 - 23:17 nvd

MEDIUM 5.3

PoC Detected

Apr 08, 2026 - 23:17 vuln.today

Public exploit code

DescriptionCVE.org

A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

SourceCodester Online Food Ordering System 1.0 allows authenticated remote attackers to manipulate product pricing through the save_product function in Actions.php, leading to business logic errors including potential negative or arbitrary price values. The vulnerability affects the POST parameter handler and carries a CVSS score of 5.3 with publicly available exploit code; while not in CISA's KEV catalog, the public exploit availability and disclosure via vuldb indicate real-world exposure.

Technical ContextAI

The vulnerability exists in the save_product function of Actions.php, a PHP-based component that processes POST parameters for product management in this web-based food ordering platform. The flaw is classified under CWE-840 (Use of Inadequately Validated Data in SQL Command), indicating insufficient input validation on the price parameter. The PHP application fails to properly sanitize or validate the price argument before using it in business logic operations, allowing an authenticated user to submit malicious price values that bypass intended constraints. This is a classic input validation weakness in web application parameter handling where numeric constraints are not enforced server-side.

RemediationAI

The primary remediation is to upgrade to a patched version of SourceCodester Online Food Ordering System if one is available from the vendor at sourcecodester.com. If no patched version is released, apply strict server-side input validation to the save_product function in Actions.php to ensure the price parameter accepts only non-negative numeric values conforming to expected currency precision (e.g., regex or type-casting to positive float). Implement database constraints (CHECK clauses) to prevent negative prices from being stored. Additionally, apply principle of least privilege by restricting product modification endpoints to authorized admin accounts only, and audit existing product records for any entries with negative or anomalous prices created prior to the fix. Monitor POST requests to Actions.php for suspicious price submissions. The public exploit is available at https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/BusinessLogic-Product-NegativePrice.md and should be reviewed to understand the attack vector for testing.