Is there a public PoC exploit available for CVE-2026-82614?

Yes, a public proof-of-concept exploit is available for CVE-2026-82614. Prioritise patching immediately. EPSS: 0.3%.

Online Medicine Delivery System CVE-2026-82614

Q: What is the CVSS score of CVE-2026-82614?

CVE-2026-82614 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-68351 MEDIUM

SQL Injection (CWE-89)

2026-08-31 VulDB

GHSA-cwfg-w7xq-ph73

PHP SQLi Online Medicine Delivery System Itsourcecode

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Unauthenticated network SQL injection with no scope change; low impact across all dimensions aligns with constrained database access and no host-level control.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Aug 31, 2026 - 10:50 cve.org

MEDIUM 5.5

CVSS changed

Aug 31, 2026 - 05:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 31, 2026 - 05:01 vuln.today

DescriptionCVE.org

A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=product of the component Product Category Filter Interface. Executing a manipulation of the argument Category can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions are required - the vulnerability is reachable by any client with network access to the web application. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) reflects an easily reachable, authentication-free attack surface with no special preconditions - a profile that historically attracts opportunistic scanning and automated exploitation tooling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis; patch status should be monitored via https://vuldb.com/cve/CVE-2026-82614. … Detailed patch versions, workarounds, and compensating controls in full report.