Is there a public PoC exploit available for CVE-2026-9445?

Yes, a public proof-of-concept exploit is available for CVE-2026-9445. Prioritise patching immediately. EPSS: 0.0%.

Simple POS System CVE-2026-9445

Q: What is the CVSS score of CVE-2026-9445?

CVE-2026-9445 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31656 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-25 VulDB

GHSA-c697-c22x-55qg

PHP File Upload Simple Pos And Inventory System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:14 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.php of the component File Extension Handler. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

Unrestricted file upload in SourceCodester Simple POS and Inventory System 1.0 allows authenticated remote attackers to upload arbitrary files through the image argument of /admin/addproduct.php, potentially enabling web shell deployment and remote code execution. A publicly available proof-of-concept exploit exists (GitHub gist), and SSVC confirms exploitation: poc status. Despite the severe nature of CWE-434 unrestricted upload flaws, EPSS sits at 0.04% (11th percentile) and CISA has not added this to KEV, indicating limited observed exploitation in the wild at time of analysis.

Technical ContextAI

The vulnerability resides in a PHP-based point-of-sale and inventory management web application developed by SourceCodester, identified by CPE cpe:2.3:a:sourcecodester:simple_pos_and_inventory_system:*:*:*:*:*:*:*:*. CWE-434 (Unrestricted Upload of File with Dangerous Type) occurs when server-side code fails to validate or sanitize uploaded file extensions and MIME types before storing them. In this case, the /admin/addproduct.php endpoint processes a product image parameter without properly enforcing an allowlist of safe file types, permitting an attacker to submit PHP scripts or other executable content. If the web server is configured to execute scripts within the upload directory - a common misconfiguration - the attacker can subsequently trigger code execution by requesting the uploaded file's URL. The CVSS 4.0 E:P modifier confirms a working proof-of-concept has been published.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fix version appears in any referenced source including VulDB, NVD, or the SourceCodester vendor site. Defenders should pursue compensating controls immediately. The highest-priority mitigation is configuring the web server (Apache or nginx) to deny execution of PHP and other scripting languages within the upload directory, which prevents uploaded web shells from being invoked even if malicious files are stored - this can be done via an .htaccess rule (Apache: 'php_flag engine off') or nginx location block with 'deny all' for script types. Restricting access to the /admin/ directory to known IP ranges or requiring VPN access eliminates remote exploitation entirely, at the cost of administrative flexibility. Additionally, implementing server-side MIME type and file extension validation to whitelist only safe image types (JPEG, PNG, GIF) before storage addresses the root cause. Monitor https://vuldb.com/vuln/365426 and https://www.sourcecodester.com/ for patch availability.