Is there a public PoC exploit available for CVE-2026-7822?

Yes, a public proof-of-concept exploit is available for CVE-2026-7822. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode Courier Management System CVE-2026-7822

Q: What is the CVSS score of CVE-2026-7822?

CVE-2026-7822 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27219 LOW

SQL Injection (CWE-89)

2026-05-05 VulDB

GHSA-2p5m-6697-7p63

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 05:30 vuln.today

Severity Changed

May 05, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 05, 2026 - 05:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was identified in itsourcecode Courier Management System 1.0. This impacts an unknown function of the file /print_pdets.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Courier Management System 1.0 via the ids parameter in /print_pdets.php allows authenticated remote attackers to execute arbitrary SQL queries with low impact to confidentiality, integrity, and availability. The vulnerability has a publicly available proof-of-concept and is characterized by low CVSS score (2.1) due to authentication requirement and limited scope, but SQL injection itself represents a persistent threat vector if the system processes sensitive courier data.

Technical ContextAI

The vulnerability exists in a PHP-based web application's print details endpoint (/print_pdets.php) where user-supplied input in the ids parameter is not properly sanitized before being incorporated into SQL queries. This is a classic SQL injection vulnerability (CWE-89) where an attacker can manipulate SQL syntax by crafting malicious ids values. The affected product is a courier management system built by itsourcecode, which likely handles shipment tracking, delivery data, and customer information. The flaw suggests the application either does not use parameterized queries or fails to validate input against expected formats (numeric identifiers).

RemediationAI

Update itsourcecode Courier Management System to a patched version released by itsourcecode following responsible disclosure. If no official patch has been released, immediately implement input validation and parameterized SQL queries in /print_pdets.php: replace dynamic SQL concatenation with prepared statements using parameterized placeholders for the ids parameter (e.g., PDO prepared statements or mysqli prepared statements in PHP). As a temporary compensating control, restrict access to /print_pdets.php to a whitelist of trusted IP addresses or implement Web Application Firewall (WAF) rules to block SQL injection payloads (characteristic patterns: quotes, comments, UNION keywords in the ids parameter). These controls are imperfect and degrade usability; apply only pending upstream fixes. Audit database logs for suspicious query patterns and review user accounts to limit privilege levels of authenticated users accessing this endpoint. Contact itsourcecode directly via https://itsourcecode.com/ for patch availability and timeline.