Is there a public PoC exploit available for CVE-2026-7076?

Yes, a public proof-of-concept exploit is available for CVE-2026-7076. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode Courier Management System CVE-2026-7076

Q: What is the CVSS score of CVE-2026-7076?

CVE-2026-7076 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25754 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 02:30 vuln.today

Severity Changed

Apr 27, 2026 - 02:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 02:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 02:15 euvd

EUVD-2026-25754

Analysis Generated

Apr 27, 2026 - 02:15 vuln.today

CVE Published

Apr 27, 2026 - 01:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /edit_branch.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in itsourcecode Courier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via manipulation of the ID parameter in /edit_branch.php. The vulnerability has publicly disclosed exploit code available and affects confidentiality, integrity, and availability of the underlying database.

Technical ContextAI

The vulnerability exists in a PHP-based web application where user-supplied input (the ID parameter) is passed directly into SQL queries without proper parameterization or input sanitization. This is a classic SQL injection vulnerability (CWE-89) where an attacker can craft malicious SQL syntax within the ID parameter to break out of the intended query context and execute arbitrary database commands. The affected file /edit_branch.php processes branch editing operations and fails to use prepared statements or parameterized queries, allowing an attacker to enumerate the database schema, extract sensitive data, modify records, or potentially achieve remote code execution depending on database permissions and configuration.

RemediationAI

Upgrade itsourcecode Courier Management System to a patched version released after version 1.0 if available from the vendor at https://itsourcecode.com/. If a patched version is not yet available, implement immediate compensating controls: apply Web Application Firewall (WAF) rules to block SQL injection patterns in the ID parameter of /edit_branch.php requests (monitor for single quotes, UNION keywords, comment syntax), restrict database user accounts powering the application to read-only or minimal write privileges to limit damage from successful injection, and implement input validation/whitelist filtering to accept only numeric or alphanumeric values for the ID parameter. Additionally, isolate the Courier Management System on a segmented network with restricted database access to reduce lateral movement risk if the system is compromised. Monitor database query logs for suspicious patterns and consider disabling the /edit_branch.php endpoint entirely if branch editing is not a critical operational function.