What is the CVSS score of EUVD-2026-16708?

EUVD-2026-16708 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-16708?

CVE-2026-30576 presents notable security risk, a input validation vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for EUVD-2026-16708?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16708. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-16708?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP EUVD-2026-16708

| CVE-2026-30576 HIGH

Improper Input Validation (CWE-20)

2026-03-27 mitre

GHSA-5jg4-m9rh-fp8f

PHP Information Disclosure N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 16:14 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 16:45 euvd

EUVD-2026-16708

Analysis Generated

Mar 27, 2026 - 16:45 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file. The application fails to validate the "txtprice" and "txttotalcost" parameters during stock entry, allowing negative financial values to be submitted. This leads to corruption of financial records, allowing attackers to manipulate inventory asset values and procurement costs.

AnalysisAI

Pharmacy Product Management System 1.0 fails to validate financial input parameters in the add-stock.php file, permitting attackers to submit negative values for product prices and total costs. This business logic vulnerability corrupts financial records and allows manipulation of inventory asset valuations and procurement cost tracking. Publicly available exploit code exists; however, no CVSS score, EPSS data, or CISA KEV confirmation is available to assess active exploitation frequency.

Technical ContextAI

The vulnerability resides in a PHP-based web application (Pharmacy Product Management System 1.0) that processes inventory stock entry operations. The affected parameters-txtprice and txttotalcost-are passed to add-stock.php without server-side numeric range or sign validation. This represents a business logic flaw (related to insufficient input validation and data constraints) rather than a code injection or authentication bypass. The absence of a assigned CWE identifier limits precise root-cause classification, but the core defect involves missing constraints on numeric input fields that should only accept non-negative values. PHP's permissive type casting and lack of enforced schema validation at the application layer enable the submission of negative numeric strings that are subsequently stored in financial ledgers.

RemediationAI

Immediately upgrade Pharmacy Product Management System to the latest patched version released by SourceCodester; consult the vendor's security advisory or release notes for exact version numbers and deployment instructions. Until a patch is deployed, implement server-side input validation in add-stock.php to reject any txtprice or txttotalcost parameter with a negative value or non-numeric input-enforce a whitelist of numeric patterns (e.g., regex ^[0-9]+(\.[0-9]{2})?$ for currency) and return HTTP 400 Bad Request on validation failure. Additionally, apply role-based access control (RBAC) to restrict stock-entry operations to authorized personnel, log all stock entry submissions with IP address and user ID for audit purposes, and review existing financial records for anomalous negative values that may indicate prior exploitation. If network isolation is feasible, restrict web application access to trusted internal networks until patching is complete.