Is there a public PoC exploit available for CVE-2026-8128?

Yes, a public proof-of-concept exploit is available for CVE-2026-8128. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester SUP Online Shopping CVE-2026-8128

Q: What is the CVSS score of CVE-2026-8128?

CVE-2026-8128 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28489 MEDIUM

SQL Injection (CWE-89)

2026-05-08 VulDB

GHSA-93h2-p56q-h6jc

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 03:30 vuln.today

Severity Changed

May 08, 2026 - 03:22 NVD

HIGH MEDIUM

CVSS changed

May 08, 2026 - 03:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

CVE Published

May 08, 2026 - 02:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.php. Performing a manipulation of the argument msgid results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester SUP Online Shopping 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via manipulation of the msgid parameter in /admin/viewmsg.php. The vulnerability has a publicly available exploit and impacts data confidentiality, integrity, and availability with a CVSS score of 5.5. While actively demonstrated through public proof-of-concept code, the lack of authentication requirements combined with network accessibility presents moderate real-world risk to exposed instances.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based e-commerce application. The /admin/viewmsg.php file fails to properly sanitize or parameterize the msgid user input before incorporating it into SQL queries. The application likely uses string concatenation or inadequate input validation when constructing database queries, allowing an attacker to inject arbitrary SQL commands. The CPE indicates all versions of SUP Online Shopping are potentially affected. PHP applications commonly fall victim to SQLi when direct string interpolation is used in query construction instead of prepared statements with bound parameters.

RemediationAI

Implement immediate input validation and parameterized queries: replace all SQL string concatenation with prepared statements using bound parameters in /admin/viewmsg.php and throughout the application. Upgrade to a patched version if the vendor releases one; check SourceCodester's official website (https://www.sourcecodester.com/) for updates. As a temporary compensating control, restrict network access to /admin/ paths using a Web Application Firewall (WAF) with SQL injection signature rules, or implement IP-based access controls limiting admin access to trusted networks only - this reduces attack surface while maintaining functionality for legitimate administrators. Additionally, apply parameterized query framework retrofitting across all user-input handling in the shopping platform, and conduct a security audit of the codebase for similar injection vulnerabilities. Monitor database logs for suspicious query patterns indicative of exploitation attempts.