Is there a public PoC exploit available for CVE-2026-7447?

Yes, a public proof-of-concept exploit is available for CVE-2026-7447. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pet Grooming Management Software CVE-2026-7447

Q: What is the CVSS score of CVE-2026-7447?

CVE-2026-7447 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26303 LOW

SQL Injection (CWE-89)

2026-04-30 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:52 vuln.today

Public exploit code

Analysis Generated

Apr 30, 2026 - 01:29 vuln.today

Severity Changed

Apr 30, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

Apr 30, 2026 - 01:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 30, 2026 - 01:15 euvd

EUVD-2026-26303

Analysis Generated

Apr 30, 2026 - 01:15 vuln.today

CVE Published

Apr 30, 2026 - 00:15 nvd

LOW 2.1

DescriptionCVE.org

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/update_customer.php. This manipulation of the argument type/length/business parameter validity causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Pet Grooming Management Software 1.0 allows authenticated remote attackers to manipulate the type, length, or business parameters in /admin/update_customer.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L) but carries low overall severity (CVSS 2.1); however, publicly available exploit code exists and the attack vector is network-accessible, making it a practical risk for multi-tenant or shared hosting deployments.

Technical ContextAI

The vulnerability exists in a PHP-based web application's customer management module. SourceCodester Pet Grooming Management Software fails to properly sanitize or parameterize user-supplied input in the /admin/update_customer.php endpoint, specifically the type, length, and business parameters. This allows SQL injection (CWE-89) attacks where an authenticated attacker can craft malicious SQL syntax within these parameters to manipulate database queries. The application likely concatenates user input directly into SQL statements without prepared statements or input validation. The CPE identifier indicates all versions (using wildcard notation) of SourceCodester Pet Grooming Management Software are potentially affected.

RemediationAI

No vendor-released patch identified at time of analysis. The primary remediation is to discontinue use of SourceCodester Pet Grooming Management Software 1.0 or contact the vendor (www.sourcecodester.com) for a patched version. Immediate compensating controls include: (1) Restrict network access to /admin/update_customer.php using web application firewall (WAF) rules to block requests containing SQL metacharacters (single quotes, semicolons, OR/AND operators) in the type, length, and business parameters - trade-off is potential false positives for legitimate business names containing special characters; (2) Implement parameterized query support or stored procedures in the application code if source code modification is possible; (3) Apply database user least-privilege access by restricting the database account used by the PHP application to SELECT and UPDATE permissions only on the customer table, preventing DROP or DELETE operations - this limits lateral damage from successful SQL injection; (4) Enable database query logging and audit the /admin/ endpoint for unusual SQL patterns. Monitor for failed login attempts to detect credential compromise leading to exploitation.