Is there a public PoC exploit available for CVE-2026-8126?

Yes, a public proof-of-concept exploit is available for CVE-2026-8126. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Comment System CVE-2026-8126

Q: What is the CVSS score of CVE-2026-8126?

CVE-2026-8126 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28488 MEDIUM

SQL Injection (CWE-89)

2026-05-08 VulDB

GHSA-rw2q-pc53-f59p

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 03:30 vuln.today

Severity Changed

May 08, 2026 - 03:22 NVD

HIGH MEDIUM

CVSS changed

May 08, 2026 - 03:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

CVE Published

May 08, 2026 - 01:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file post_comment.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Comment System 1.0 allows remote unauthenticated attackers to manipulate the Name argument in post_comment.php, enabling arbitrary SQL query execution with low confidentiality and integrity impact. Publicly available exploit code exists and the attack requires no special user interaction or authentication, making it accessible to any network-connected attacker.

Technical ContextAI

SourceCodester Comment System is a PHP-based web application component designed to handle user comments. The vulnerability resides in the post_comment.php file, which processes incoming comment submissions. The Name parameter is passed directly into SQL queries without proper input validation or parameterized query preparation, violating CWE-89 (SQL Injection) principles. This is a classic first-generation web application flaw common in legacy PHP systems that concatenate user input into query strings rather than using prepared statements or bound parameters. The CPE indicates all versions of the product are affected.

RemediationAI

Immediate action required: upgrade to a patched version if the vendor releases one, or discontinue use of this component and migrate to a maintained, actively-supported comment system with secure input handling. If immediate upgrade is not feasible, implement the following compensating controls: (1) Use Web Application Firewall (WAF) rules to detect and block SQL injection payloads in the Name parameter (trade-off: WAF rules may produce false positives and require ongoing tuning); (2) Disable or restrict access to post_comment.php at the network perimeter using reverse proxy rules, allowing comments only from authenticated internal sources (trade-off: impacts user-facing comment functionality); (3) Apply strict input validation on the Name parameter at the application level, rejecting non-alphanumeric characters and enforcing maximum length limits (trade-off: may break legitimate comment names with special characters); (4) Run the database connection with minimal privileges (read-only to the comments table where possible) to limit the scope of an SQL injection attack (trade-off: requires database architecture review and may require application code changes). No vendor-released patch is confirmed at this time; consult https://www.sourcecodester.com/ for updates.