Is there a public PoC exploit available for CVE-2026-6187?

Yes, a public proof-of-concept exploit is available for CVE-2026-6187. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6187

Q: What is the CVSS score of CVE-2026-6187?

CVE-2026-6187 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22012 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-qprq-3xhq-p84p

PHP SQLi Pharmacy Sales And Inventory System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 16:43 vuln.today

Severity Changed

Apr 13, 2026 - 16:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 16:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 16:15 euvd

EUVD-2026-22012

Analysis Generated

Apr 13, 2026 - 16:15 vuln.today

CVE Published

Apr 13, 2026 - 15:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=chk_prod_availability. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /ajax.php?action=chk_prod_availability, enabling unauthorized data access and modification. The vulnerability has a publicly available exploit and carries a CVSS score of 6.9 with confirmed proof-of-concept code available on GitHub.

Technical ContextAI

The vulnerability exists in a PHP-based inventory management application that fails to properly sanitize user-supplied input before incorporating it into SQL queries. The affected endpoint /ajax.php?action=chk_prod_availability processes an ID parameter without parameterized queries or input validation, enabling classic SQL injection attacks. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: the application directly concatenates untrusted user input into SQL statements. This is a fundamental flaw in secure coding practices where dynamic query construction without prepared statements or parameterized queries permits attackers to alter query logic and access or manipulate backend database contents.

RemediationAI

The primary remediation is to upgrade SourceCodester Pharmacy Sales and Inventory System to a patched version released by the vendor that addresses SQL injection in the chk_prod_availability action. If an upgraded version is not immediately available, implement input validation and parameterized queries (prepared statements) in the /ajax.php file to sanitize the ID parameter before database operations. Apply database-level access controls to restrict the web application's database user to minimum required privileges. Additionally, deploy a Web Application Firewall (WAF) with SQL injection detection rules as a temporary compensating control. Consult https://www.sourcecodester.com/ for official security updates and advisories. Detailed vulnerability information is available at https://vuldb.com/vuln/357109.