Is there a public PoC exploit available for CVE-2026-9444?

Yes, a public proof-of-concept exploit is available for CVE-2026-9444. Prioritise patching immediately. EPSS: 0.0%.

Simple POS System CVE-2026-9444

Q: What is the CVSS score of CVE-2026-9444?

CVE-2026-9444 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31657 LOW

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-wq78-w3qj-qc93

PHP SQLi Simple Pos And Inventory System

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:05 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

4.7 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A vulnerability was detected in SourceCodester Simple POS and Inventory System 1.0. This issue affects the function delete of the file /admin/deleteproduct.php of the component GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Simple POS and Inventory System 1.0 allows a remote, high-privileged (admin-level) attacker to manipulate database queries via the unsanitized 'ID' GET parameter in /admin/deleteproduct.php. Successful exploitation yields partial read, write, and availability impact on the underlying database. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists (GitHub gist), though no confirmed active exploitation (KEV) has been observed, and the EPSS score of 0.03% reflects minimal real-world exploitation pressure.

Technical ContextAI

The affected application is a PHP-based point-of-sale and inventory management system distributed by SourceCodester (cpe:2.3:a:sourcecodester:simple_pos_and_inventory_system:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the application constructs SQL queries by directly concatenating user-supplied GET parameter values - specifically the 'ID' argument passed to the delete function in /admin/deleteproduct.php - without parameterized queries or adequate input sanitization. This is a classic unsanitized PHP-to-MySQL (or similar RDBMS) interpolation pattern common in SourceCodester community-edition scripts. The wildcard version in the CPE string suggests no patched release has been catalogued.

RemediationAI

No vendor-released patch identified at time of analysis - SourceCodester community scripts typically do not receive formal security updates. The primary remediation is to replace direct GET parameter interpolation in /admin/deleteproduct.php with PHP PDO or MySQLi prepared statements and bound parameters, which eliminates the SQL injection root cause; this requires code modification by the deploying organization. As a compensating control, deployers should restrict administrative panel access (/admin/*) to trusted IP ranges via web server configuration (e.g., nginx allow/deny or Apache mod_authz_host), reducing exposure to the high-privileged endpoint required for exploitation - trade-off is operational friction for remote admins. Deploying a web application firewall rule to block SQL metacharacters in GET parameters targeting /admin/deleteproduct.php is an additional layer but is bypassable without proper input handling. The VulDB advisory is available at https://vuldb.com/vuln/365425. The public POC is documented at https://gist.github.com/c4ttr4ck/5d05aaee5b43f259ebe8bb8bce5c658f and should be reviewed to understand exact payload patterns.