Is there a public PoC exploit available for CVE-2026-9447?

Yes, a public proof-of-concept exploit is available for CVE-2026-9447. Prioritise patching immediately. EPSS: 0.0%.

Simple POS System CVE-2026-9447

Q: What is the CVSS score of CVE-2026-9447?

CVE-2026-9447 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31663 MEDIUM

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-5mrm-49cw-f335

PHP SQLi Simple Pos And Inventory System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:51 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:37 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /user/search.php. Performing a manipulation of the argument Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Simple POS and Inventory System 1.0 exposes the application to unauthenticated remote data extraction and manipulation via the Name parameter in /user/search.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a publicly available proof-of-concept exploit (GitHub gist) lowers the bar for exploitation. No active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.03% (9th percentile) indicates limited real-world exploitation activity at time of analysis despite the public POC.

Technical ContextAI

The affected application is a PHP-based point-of-sale and inventory management system distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:simple_pos_and_inventory_system:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input in the Name argument passed to /user/search.php is not sanitized or parameterized before being interpolated into a SQL query. This is a classic unsanitized string concatenation flaw common in PHP applications that rely on direct database query construction rather than prepared statements or ORM abstraction layers. The wildcard CPE indicates all sub-versions of 1.0 are affected, though only version 1.0 is confirmed via EUVD affected version data.

RemediationAI

No vendor-released patch has been identified at time of analysis - SourceCodester does not appear to have issued an advisory or updated release. The primary remediation is to replace direct string interpolation in the SQL query within /user/search.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions, which eliminates the injection surface entirely. As an immediate compensating control, restrict access to /user/search.php at the web server or firewall level so that only authenticated, trusted internal users can reach the endpoint - note this may disrupt legitimate search functionality for external users. Deploying a Web Application Firewall (WAF) with SQL injection rules targeting the Name parameter can reduce exploitation risk without code changes, though WAF bypass techniques exist and this should not be treated as a permanent fix. The VulDB advisory is available at https://vuldb.com/vuln/365428 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9447.