Is there a public PoC exploit available for CVE-2026-9377?

Yes, a public proof-of-concept exploit is available for CVE-2026-9377. Prioritise patching immediately. EPSS: 0.0%.

SUP Online Shopping CVE-2026-9377

Q: What is the CVSS score of CVE-2026-9377?

CVE-2026-9377 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31589 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-24 VulDB

GHSA-29h5-px7p-c3gq

PHP XSS Sup Online Shopping

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:04 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

2.4 (LOW) 1.9 (LOW)

DescriptionCVE.org

A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The manipulation of the argument productName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Cross-site scripting in SourceCodester SUP Online Shopping 1.0 is exploitable via the productName parameter in /admin/productedit.php, where unsanitized input is rendered back to the browser without proper encoding. An attacker already holding high-privilege admin credentials can inject a JavaScript payload that executes when another user interacts with the affected admin page. Publicly available exploit code exists per a referenced GitHub issue, though EPSS at 0.03% (9th percentile) and absence from CISA KEV indicate negligible active exploitation interest at time of analysis.

Technical ContextAI

The affected application is SourceCodester SUP Online Shopping 1.0, a PHP-based e-commerce platform (CPE: cpe:2.3:a:sourcecodester:sup_online_shopping:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), a class of flaw where user-supplied input to the productName argument in the /admin/productedit.php administrative endpoint is reflected or stored without output encoding. PHP applications that render untrusted user input directly into HTML responses without applying htmlspecialchars() or equivalent functions are a canonical source of this vulnerability class. The flaw resides entirely within the administrative interface, meaning the attack surface is limited to the admin panel and authenticated sessions that interact with product editing functionality.

RemediationAI

No vendor-released patch has been identified at time of analysis for SourceCodester SUP Online Shopping 1.0; the vendor site at https://www.sourcecodester.com/ and VulDB entry https://vuldb.com/vuln/365340 should be monitored for future releases. As a direct code-level fix, the productName input should be sanitized using PHP's htmlspecialchars() with ENT_QUOTES encoding before rendering in /admin/productedit.php; this requires direct source modification and testing for regressions in product name display. As an architectural control, access to the /admin/ directory should be restricted to trusted internal IP ranges via server or firewall configuration, reducing the network-reachable attack surface at the cost of blocking remote admin access. Deploying a WAF rule targeting XSS patterns in the productName parameter provides an additional layer of defense, though legitimate product names containing special characters (ampersands, angle brackets) may trigger false positives and require tuning.