Is there a public PoC exploit available for EUVD-2026-28519?

Yes, a public proof-of-concept exploit is available for EUVD-2026-28519. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester SUP Online Shopping EUVD-2026-28519

Q: What is the CVSS score of EUVD-2026-28519?

EUVD-2026-28519 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8130 MEDIUM

SQL Injection (CWE-89)

2026-05-08 VulDB

GHSA-gxmg-m8j9-9hxw

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 04:30 vuln.today

Severity Changed

May 08, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

May 08, 2026 - 04:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

CVE Published

May 08, 2026 - 02:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /admin/message.php. The manipulation of the argument seenid leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester SUP Online Shopping 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the seenid parameter in /admin/message.php. The vulnerability has a publicly available exploit and presents moderate confidentiality and integrity risk with a CVSS score of 5.5, though impact is limited to partial data access and modification without availability impact.

Technical ContextAI

The vulnerability exists in a PHP-based e-commerce application (SUP Online Shopping) and stems from improper input validation in the seenid parameter passed to /admin/message.php. This is a classic SQL injection flaw (CWE-89) where user-supplied input is directly concatenated or used in SQL queries without parameterized statements or proper escaping. The attack vector is network-based with low complexity, indicating the application accepts HTTP requests to the vulnerable endpoint without authentication or special configuration. CPE cpe:2.3:a:sourcecodester:sup_online_shopping:*:*:*:*:*:*:*:* indicates all versions of this product are potentially affected, though the CVE specifically references version 1.0.

RemediationAI

Upgrade SourceCodester SUP Online Shopping to a patched version released by the vendor (patch version not explicitly confirmed from available references; contact vendor at https://www.sourcecodester.com/ for availability). As an interim compensating control, implement parameterized queries or prepared statements in /admin/message.php to handle the seenid parameter, replacing any string concatenation in SQL with bound parameters. Additionally, restrict access to /admin/ directory to specific trusted IP addresses via web server configuration (Apache .htaccess or nginx location block), implement a Web Application Firewall (WAF) rule to block requests containing SQL injection payloads in the seenid parameter (e.g., keywords like UNION, SELECT, OR 1=1), and enforce strict input validation to accept only expected numeric or alphanumeric formats for seenid. These controls reduce exploitability but do not replace patching.