What is the CVSS score of CVE-2026-9364?

CVE-2026-9364 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-9364?

Yes, a public proof-of-concept exploit is available for CVE-2026-9364. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9364?

Within 24 hours: Inventory all systems running Online Art Gallery Shop 1.0 and isolate affected instances from production networks if operationally feasible. Within 7 days: Implement network-level access controls restricting access to /admin/adminHome.php to authorized IP ranges only, and apply Web Application Firewall (WAF) rules to block SQL injection patterns in the social_linked parameter. Within 30 days: Contact the vendor for patch availability; if unavailable, evaluate migration to a patched alternative product or implement comprehensive input validation and parameterized query rewrites at the application layer.

Online Art Gallery Shop CVE-2026-9364

EUVD-2026-31577 MEDIUM

SQL Injection (CWE-89)

2026-05-24 VulDB

GHSA-g656-j3x6-4jgg

PHP SQLi Online Art Gallery Shop Projectworlds

5.5

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send HTTP request to /admin/adminHome.php
Exploit

Inject SQL via social_linked parameter
Execution

Execute arbitrary SQL commands
Impact

Extract or modify database contents

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of Online Art Gallery Shop 1.0. The vulnerable endpoint /admin/adminHome.php must be accessible from the attacker's network position. Note that while the path suggests an admin interface, the CVSS vector confirms no authentication is required (PR:N), indicating either a misconfiguration or design flaw in access controls.
Impact	The vulnerability presents high real-world risk based on multiple factors. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation with low complexity and no user interaction required. The EPSS data is not provided, but the existence of publicly available exploit code significantly increases the likelihood of exploitation. The CVSS environmental metrics show E:P (proof-of-concept exists) and RC:R (reasonable confidence), aligning with the published exploit on GitHub. This is not listed in CISA KEV, suggesting it may not be actively exploited at scale yet, but the low barrier to exploitation makes it a priority for systems running this software.
Exploit ScenarioDerived	An attacker sends a crafted HTTP request to /admin/adminHome.php with malicious SQL code in the social_linked parameter. The injected SQL executes in the database context, potentially allowing data extraction, modification, or deletion. Given the admin panel context, this could lead to full application compromise.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 24, 2026

SQL injection in Online Art Gallery Shop 1.0 allows unauthenticated remote attackers to manipulate database queries through the social_linked parameter in /admin/adminHome.php. The vulnerability has publicly available exploit code and a CVSS score of 7.3, indicating high severity with the ability to impact confidentiality, integrity, and availability of the application.

RemediationAI

No vendor-released patch identified at time of analysis. As an immediate mitigation, restrict access to /admin/adminHome.php through web server access controls or authentication mechanisms, though this may break legitimate admin functionality. Implement input validation and parameterized queries for the social_linked parameter if source code access is available. Consider deploying a Web Application Firewall (WAF) with SQL injection rules as a temporary measure, though determined attackers may bypass generic rules. Monitor database logs for suspicious queries targeting the admin panel.

Affected VersionsENISA

Online Art Gallery Shop 1.0

Affected Packages

euvd online_art_gallery_shop no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Online Art Gallery Shop is a PHP-based web application by projectworlds. The vulnerability stems from improper input validation in the admin panel file /admin/adminHome.php, specifically when processing the social_linked parameter. This is a classic SQL injection vulnerability (CWE-89) where user-supplied input is incorporated into SQL queries without proper sanitization or parameterization, allowing attackers to inject arbitrary SQL commands.

Know when Online Art Gallery Shop gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

May 26, 2026 - 19:37 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:37 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A flaw has been found in projectworlds Online Art Gallery Shop 1.0. Impacted is an unknown function of the file /admin/adminHome.php. Executing a manipulation of the argument social_linked can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

Executive ViewAI

Why It Matters

CVE-2026-9364 is a high-severity SQL injection vulnerability in Online Art Gallery Shop 1.0 that allows unauthenticated attackers to compromise database integrity and extract sensitive data through the administrative interface. Organizations running this application face immediate risk of data breach and system compromise, as exploit code is publicly available and no vendor patch is currently available.

Business Impact: High

Compensating Controls

Network segmentation restricting /admin/adminHome.php access to trusted administrative networks; Web Application Firewall rules blocking SQL injection payloads in the social_linked parameter; database activity monitoring to detect anomalous queries; consider disabling the social_linked feature if not operationally required.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.