Is there a public PoC exploit available for EUVD-2026-20835?

Yes, a public proof-of-concept exploit is available for EUVD-2026-20835. Prioritise patching immediately. EPSS: 0.0%.

PHP EUVD-2026-20835

Q: What is the CVSS score of EUVD-2026-20835?

EUVD-2026-20835 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5836 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 VulDB

GHSA-pg87-8q7g-m8pp

XSS PHP Online Shoe Store

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 09, 2026 - 04:17 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 03:30 euvd

EUVD-2026-20835

Analysis Generated

Apr 09, 2026 - 03:30 vuln.today

CVE Published

Apr 09, 2026 - 03:00 nvd

MEDIUM 4.8

DescriptionCVE.org

A vulnerability has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_product.php. The manipulation of the argument product_name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Online Shoe Store 1.0 allows authenticated administrators to inject malicious scripts via the product_name parameter in /admin/admin_product.php, affecting other users who view the product data. The vulnerability requires high-privilege admin access and user interaction (clicking/viewing), limiting immediate risk, but publicly available exploit code exists and the issue has been disclosed. With a CVSS score of 2.4 and exploitation probability marked as proof-of-concept (E:P), this is a low-severity issue primarily affecting self-hosted instances of the affected software.

Technical ContextAI

The vulnerability is a reflected or stored cross-site scripting (CWE-79) flaw in a PHP-based e-commerce application. The Online Shoe Store application fails to properly sanitize or encode user input in the product_name parameter before storing or rendering it in the /admin/admin_product.php file. Since the CVSS vector indicates PR:H (high privileges required), this is an admin-level XSS attack. The application likely uses direct string interpolation or inadequate output encoding when displaying product information, allowing attackers with administrative credentials to craft JavaScript payloads that execute in the browsers of other users or administrators accessing the product management interface. The CPE cpe:2.3:a:code-projects:online_shoe_store:*:*:*:*:*:*:*:* indicates this affects the Online Shoe Store product across all versions, though only version 1.0 is explicitly confirmed.

RemediationAI

Implement proper input validation and output encoding for the product_name parameter in /admin/admin_product.php. Use PHP's htmlspecialchars() or htmlentities() functions when displaying product names in HTML contexts, or use prepared statements and templating engines that automatically escape output. Validate the product_name input length and character set server-side before storing in the database. Upgrade to a patched version if released by code-projects; consult code-projects.org for security updates. Additionally, enforce strong administrative password policies and implement Content Security Policy (CSP) headers to mitigate XSS impact. If no patch is available, apply WAF rules to filter script tags in POST requests to /admin/admin_product.php.