Is there a public PoC exploit available for EUVD-2026-20787?

Yes, a public proof-of-concept exploit is available for EUVD-2026-20787. Prioritise patching immediately. EPSS: 0.0%.

PHP EUVD-2026-20787

Q: What is the CVSS score of EUVD-2026-20787?

EUVD-2026-20787 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5810 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 cna@vuldb.com

GHSA-4phh-x97m-378h

PHP XSS

2.0

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Apr 08, 2026 - 22:24 euvd

EUVD-2026-20787

Analysis Generated

Apr 08, 2026 - 22:24 vuln.today

CVE Published

Apr 08, 2026 - 22:16 nvd

MEDIUM 5.1

PoC Detected

Apr 08, 2026 - 22:16 vuln.today

Public exploit code

DescriptionCVE.org

A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

Stored cross-site scripting (XSS) in SourceCodester Sales and Inventory System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID parameter in /delete.php, which are executed in the context of other users' browsers when they interact with the affected page. The vulnerability requires user interaction (clicking a malicious link) but has a published proof-of-concept and CVSS 5.1 score reflecting moderate impact on data integrity; exploitation is confirmed possible but not currently in CISA KEV.

Technical ContextAI

The vulnerability is a reflected or stored cross-site scripting flaw (CWE-79) in a PHP-based inventory management application. The /delete.php endpoint's GET parameter handler fails to sanitize or encode the ID parameter before rendering it in the HTTP response, allowing an attacker to inject arbitrary JavaScript. The root cause is improper input validation and output encoding in the GET Parameter Handler component, which is common in legacy PHP applications that lack HTML entity encoding or Content Security Policy protections. The application is built on PHP (as indicated by tags) and likely uses direct string concatenation or insufficient templating escape functions when processing user-supplied ID values.

RemediationAI

The primary remediation is to upgrade SourceCodester Sales and Inventory System to a patched version if available from the vendor; however, no vendor-released patch version has been identified at time of analysis. Immediate temporary mitigations include: (1) implementing HTML entity encoding for all user-supplied input rendered in HTTP responses, specifically ensuring ID parameters are passed through htmlspecialchars() or equivalent before output; (2) applying a Content Security Policy (CSP) header to restrict inline script execution; (3) validating ID parameters to accept only numeric values or whitelisted alphanumeric patterns, rejecting any containing special characters; and (4) restricting /delete.php access via WAF rules or network controls to trusted internal users only. Contact SourceCodester at www.sourcecodester.com to inquire about security updates or consider migrating to a maintained inventory system with active security practices.