PHP EUVD-2026-19142

Q: What is the CVSS score of EUVD-2026-19142?

EUVD-2026-19142 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5606 MEDIUM

SQL Injection (CWE-89)

2026-04-06 VulDB

PHP SQLi

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 06, 2026 - 00:15 euvd

EUVD-2026-19142

Analysis Generated

Apr 06, 2026 - 00:15 vuln.today

CVE Published

Apr 06, 2026 - 00:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /order-details.php of the component Parameter Handler. The manipulation of the argument orderid results in sql injection. It is possible to launch the attack remotely.

AnalysisAI

SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to execute arbitrary SQL queries via the orderid parameter in /order-details.php, enabling data exfiltration and database manipulation. CVSS 6.3 reflects authenticated access requirement and limited scope; no public exploit code or active KEV status confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in the Parameter Handler component of /order-details.php, where user-supplied input in the orderid parameter is passed unsanitized to SQL queries (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The affected application is PHPGurukul Online Shopping Portal Project, a PHP-based e-commerce platform. The root cause is insufficient input validation and parameterized query enforcement, allowing attackers to inject arbitrary SQL syntax when manipulating the orderid field. CPE cpe:2.3:a:phpgurukul:online_shopping_portal_project:*:*:*:*:*:*:*:* indicates all versions are potentially affected, though version 2.1 is explicitly identified.

RemediationAI

Immediate remediation requires upgrading PHPGurukul Online Shopping Portal Project to a patched version if available from the vendor; however, no specific fix version is documented in available references. As an interim measure, implement input validation and parameterized SQL queries for the orderid parameter in /order-details.php to prevent SQL injection. Apply strict whitelist validation ensuring orderid contains only expected numeric or alphanumeric identifiers, and consider using prepared statements or ORM frameworks to eliminate dynamic SQL construction. Restrict access to /order-details.php to authenticated users only (already enforced per CVSS PR:L), and monitor order management logs for suspicious query patterns. Consult phpgurukul.com and the GitHub issue tracker (https://github.com/f1rstb100d/CVE/issues/13) for community-provided patches or updated code.