Which versions of PHP are affected by EUVD-2026-14658?

A critical SQL injection vulnerability in SourceCodester E-Commerce Site v1.0 allows unauthenticated attackers to compromise database integrity and confidentiality.

Is there a public PoC exploit available for EUVD-2026-14658?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14658. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14658?

Within 24 hours: Audit all systems running SourceCodester E-Commerce v1.0 and immediately take affected applications offline or restrict network access to trusted sources only. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the /products.php Search parameter, implement input validation/parameterized queries through code patches if internal development is possible, or migrate to an alternative e-commerce platform. Within 30 days: Complete migration away from vulnerable software or obtain vendor security patch if released; conduct forensic analysis to detect exploitation attempts in logs and implement database access monitoring.

PHP EUVD-2026-14658

Q: What is the CVSS score of EUVD-2026-14658?

EUVD-2026-14658 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4613 MEDIUM

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-cq28-h8qx-hggv

PHP SQLi E Commerce Site Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 24, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 23:30 euvd

EUVD-2026-14658

Analysis Generated

Mar 23, 2026 - 23:30 vuln.today

CVE Published

Mar 23, 2026 - 23:04 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in SourceCodester E-Commerce Site 1.0. This vulnerability affects unknown code of the file /products.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester E-Commerce Site 1.0 through the Search parameter in /products.php enables unauthenticated remote attackers to read, modify, and delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available, putting all installations at immediate risk.

Technical ContextAI

This vulnerability is classified as CWE-89 (SQL Injection) affecting SourceCodester E-Commerce Site 1.0 (CPE: cpe:2.3:a:sourcecodester:e-commerce_site:*:*:*:*:*:*:*:*). The flaw exists in the products.php file, a PHP-based component responsible for product search functionality. Insufficient input validation and sanitization of the Search parameter allows attackers to break out of the intended SQL query context and execute arbitrary SQL commands against the backend database. This is a classic example of untrusted user input being directly concatenated into SQL queries without proper parameterization or escaping, a common vulnerability in legacy PHP applications and educational code examples.

RemediationAI

The CVSS Remediation Level (RL:X) indicates no official patch is currently available from the vendor. Organizations running SourceCodester E-Commerce Site 1.0 should immediately implement compensating controls including input validation using prepared statements or parameterized queries for all database interactions in products.php, specifically for the Search parameter. As a temporary measure, deploy a web application firewall (WAF) with SQL injection detection rules to filter malicious input targeting /products.php. Given the lack of vendor support typical for free educational source code, consider migrating to a commercially supported or actively maintained e-commerce platform. If continuing to use this software, manually patch the vulnerability by implementing PDO prepared statements or mysqli parameter binding for all user-supplied input in the search functionality. Restrict database user privileges to minimum necessary permissions to limit potential damage from successful exploitation.