Is there a public PoC exploit available for EUVD-2026-20803?

Yes, a public proof-of-concept exploit is available for EUVD-2026-20803. Prioritise patching immediately. EPSS: 0.0%.

PHP EUVD-2026-20803

Q: What is the CVSS score of EUVD-2026-20803?

EUVD-2026-20803 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5812 LOW

Business Logic Errors (CWE-840)

2026-04-08 cna@vuldb.com

GHSA-rxwr-mqgv-rc55

PHP Information Disclosure

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 08, 2026 - 23:24 euvd

EUVD-2026-20803

Analysis Generated

Apr 08, 2026 - 23:24 vuln.today

CVE Published

Apr 08, 2026 - 23:17 nvd

MEDIUM 5.3

PoC Detected

Apr 08, 2026 - 23:17 vuln.today

Public exploit code

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-sales.php of the component POST Parameter Handler. Performing a manipulation of the argument txtqty results in business logic errors. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Unauthenticated remote attackers can manipulate the txtqty POST parameter in SourceCodester Pharmacy Product Management System 1.0's add-sales.php to trigger business logic errors and cause data integrity violations. The vulnerability affects an unknown component of the POST parameter handler and allows modification of sales quantity values, resulting in integrity and availability impacts. Publicly available exploit code exists, and the flaw requires user authentication but is trivially exploitable with low attack complexity.

Technical ContextAI

The vulnerability exists in the add-sales.php file of SourceCodester Pharmacy Product Management System version 1.0, which processes POST parameters for sales transaction creation. The affected component is the POST Parameter Handler that processes the txtqty (transaction quantity) argument without proper input validation or business logic enforcement. CWE-840 (Use of Insufficiently Random Values) suggests the root cause involves inadequate validation mechanisms that fail to constrain quantity values to legitimate ranges (e.g., non-negative integers, inventory limits). The flaw is classified as a PHP-based web application vulnerability involving information disclosure and business logic manipulation, allowing attackers to submit invalid quantity values that bypass server-side controls.

RemediationAI

Apply immediate input validation to the txtqty parameter in add-sales.php to enforce non-negative integer values, maximum quantity limits based on inventory availability, and reject submissions containing leading zeros or special characters. Implement server-side business logic validation that cross-checks quantity values against actual stock levels before committing transactions. Review and patch the SourceCodester Pharmacy Product Management System-check https://www.sourcecodester.com/ and the project repository for available security updates beyond version 1.0. If a patched version is available, upgrade immediately. As a temporary mitigation, restrict add-sales.php access to trusted internal users only via network segmentation or IP whitelisting, and implement application-level logging to detect manipulation attempts. Conduct a full code review of the POST Parameter Handler component for similar validation flaws in other parameters.