Is there a public PoC exploit available for EUVD-2026-28518?

Yes, a public proof-of-concept exploit is available for EUVD-2026-28518. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester SUP Online Shopping EUVD-2026-28518

Q: What is the CVSS score of EUVD-2026-28518?

EUVD-2026-28518 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8129 MEDIUM

SQL Injection (CWE-89)

2026-05-08 VulDB

GHSA-rm8r-x5mx-f7w9

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 04:30 vuln.today

Severity Changed

May 08, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

May 08, 2026 - 04:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

CVE Published

May 08, 2026 - 02:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file wishlist.php. Executing a manipulation of the argument delwlistid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester SUP Online Shopping 1.0 allows remote unauthenticated attackers to manipulate the delwlistid parameter in wishlist.php, enabling arbitrary SQL query execution with potential impact on data confidentiality and integrity. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk despite the moderate CVSS 5.5 score.

Technical ContextAI

The vulnerability exists in a PHP-based e-commerce application (SourceCodester SUP Online Shopping). The wishlist.php endpoint fails to properly sanitize user-supplied input in the delwlistid parameter before incorporating it into SQL queries, violating CWE-89 (SQL Injection). The attack vector is network-based with no authentication required, indicating the vulnerable endpoint is directly accessible to unauthenticated remote users. PHP's PDO or mysqli libraries are likely affected if parameterized queries are not used.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate remediation requires: (1) input validation and parameterized queries (prepared statements with bound parameters) in wishlist.php for the delwlistid parameter to prevent SQL injection, (2) web application firewall rules to block SQL keywords in the delwlistid parameter, or (3) disabling the wishlist feature entirely if not critical to business operations. Short-term compensating controls include network segmentation to restrict access to the shopping application and monitoring of database query logs for suspicious SQL patterns. SourceCodester applications are typically self-hosted; patch application requires manual code update from the developer or deployment of a patched fork. Organizations should contact SourceCodester directly via https://www.sourcecodester.com/ for guidance, though timely response is not guaranteed for community-developed code.