Is there a public PoC exploit available for CVE-2026-9607?

Yes, a public proof-of-concept exploit is available for CVE-2026-9607. Prioritise patching immediately. EPSS: 0.0%.

Courier Management System CVE-2026-9607

Q: What is the CVSS score of CVE-2026-9607?

CVE-2026-9607 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32026 LOW

SQL Injection (CWE-89)

2026-05-27 VulDB

GHSA-gq47-jjfp-q45r

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 00:27 vuln.today

Severity Changed

May 27, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

May 27, 2026 - 00:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcel_list.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in itsourcecode Courier Management System 1.0 allows low-privileged authenticated remote attackers to manipulate backend database queries via the unsanitized 's' parameter in /parcel_list.php. A proof-of-concept exploit is publicly available on GitHub, meaningfully lowering the barrier to exploitation despite the low CVSS 4.0 score of 2.1. No vendor patch has been identified at time of analysis, leaving deployments reliant on compensating controls.

Technical ContextAI

The affected application is a PHP-based courier management web application distributed by itsourcecode, likely running on a standard LAMP stack. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 's' parameter passed to /parcel_list.php is incorporated into a backend SQL query without sanitization or parameterization, enabling an attacker to inject arbitrary SQL syntax. The CPE string cpe:2.3:a:itsourcecode:courier_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD does not scope the vulnerability to a single release - all distributed versions may share the flaw. Classic PHP-MySQL SQLi of this class typically enables UNION-based or blind data extraction; depending on database user privileges, OUT FILE-based code execution may also be possible, though that impact is not confirmed by available data.

RemediationAI

No vendor-released patch has been identified at time of analysis for itsourcecode Courier Management System 1.0. The definitive code-level fix requires replacing dynamic SQL string concatenation in /parcel_list.php with parameterized queries using PDO or MySQLi prepared statements in PHP - this eliminates the injection surface entirely. As a compensating control, administrators should restrict access to /parcel_list.php via IP-based allowlisting at the firewall or web server layer, limiting the attack surface to trusted networks only; note this adds operational friction for distributed users. A WAF rule targeting SQLi patterns on the 's' parameter (e.g., ModSecurity CRS rule sets) can reduce opportunistic exploitation risk, though WAF bypass techniques exist and this should not be treated as a complete mitigation. If the application is internet-facing and non-critical, taking it offline until a code-level fix is applied is the most conservative option. Review the PoC at https://github.com/ltranquility/cve_submit/issues/19 and the VulDB disclosure at https://vuldb.com/vuln/365680 for technical remediation context.