Is there a public PoC exploit available for CVE-2026-8131?

Yes, a public proof-of-concept exploit is available for CVE-2026-8131. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester SUP Online Shopping CVE-2026-8131

Q: What is the CVSS score of CVE-2026-8131?

CVE-2026-8131 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28520 MEDIUM

SQL Injection (CWE-89)

2026-05-08 VulDB

GHSA-qm5g-9237-pg9r

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 04:34 vuln.today

Severity Changed

May 08, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

May 08, 2026 - 04:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

CVE Published

May 08, 2026 - 03:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the file /admin/replymsg.php. The manipulation of the argument msgid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester SUP Online Shopping 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the msgid parameter in /admin/replymsg.php, enabling data extraction or modification. Publicly available exploit code exists and the vulnerability has a CVSS score of 5.5 with confirmed low impact to confidentiality, integrity, and availability.

Technical ContextAI

The vulnerability resides in the /admin/replymsg.php file, a PHP-based administrative endpoint in the SUP Online Shopping e-commerce platform. The root cause is classified as CWE-89 (SQL Injection), indicating that user-supplied input from the msgid parameter is concatenated directly into SQL queries without proper parameterization or escaping. This is a classic web application vulnerability pattern in PHP applications that fail to use prepared statements or input validation before constructing database queries.

RemediationAI

Immediate patching or upgrade is the primary remediation; however, no vendor-released patch version has been identified at the time of analysis. Administrators should contact SourceCodester directly via sourcecodester.com or their support channel to obtain a security update or patch for version 1.0. As an interim compensating control, restrict network access to the /admin/replymsg.php endpoint using a Web Application Firewall (WAF) or network access control list, allowing only trusted administrative IP ranges. Additionally, implement input validation and sanitization on the msgid parameter server-side, and refactor the application to use parameterized SQL queries (prepared statements) instead of string concatenation. Disable the /admin directory from public internet access if the application is not intended for remote administration. These controls reduce but do not eliminate risk; vendor patching remains necessary for complete remediation.