Is PHP affected by EUVD-2026-22016?

SourceCodester Pharmacy Sales and Inventory System 1.0 contains an unauthenticated SQL injection vulnerability in the login function that allows attackers to directly access, modify, or delete critical pharmacy inventory and sales data without credentials.

EUVD-2026-22016

| CVE-2026-6189 MEDIUM

2026-04-13 VulDB

GHSA-f7v4-47q7-f3fq

SQLi PHP

6.9

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 13, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS Changed

Apr 13, 2026 - 17:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 17:14 vuln.today

DescriptionNVD

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=login. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the Username parameter in /ajax.php?action=login. The vulnerability enables low-complexity attacks requiring no user interaction, with publicly available exploit code (EPSS probability data not provided, not listed in CISA KEV). …

RemediationAI

Within 24 hours: Identify all instances of SourceCodester Pharmacy Sales and Inventory System 1.0 in production and isolate affected systems from external networks if operationally feasible. Within 7 days: Implement Web Application Firewall (WAF) rules blocking SQL injection patterns in the /ajax.php?action=login endpoint; apply input validation and parameterized queries if internal development resources are available. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

EUVD-2026-22016 vulnerability details – vuln.today

Back

EUVD-2026-22016

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Analysis

Full analysis requires sign-in

Share

EUVD-2026-22016

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code