Is there a public PoC exploit available for EUVD-2026-31660?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31660. Prioritise patching immediately. EPSS: 0.0%.

Simple POS and Inventory System EUVD-2026-31660

Q: What is the CVSS score of EUVD-2026-31660?

EUVD-2026-31660 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9446 LOW

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-x95h-98hc-r7w9

PHP SQLi Simple Pos And Inventory System

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:14 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

4.7 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit_customer.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Simple POS and Inventory System 1.0 allows remote authenticated administrators to manipulate database queries via the ID parameter in /admin/edit_customer.php. The vulnerability is tagged CWE-89 and carries a CVSS 4.0 base score of 2.0, reflecting the high privilege requirement that significantly limits the attacker pool to those with existing admin access. Publicly available exploit code exists (hosted on GitHub Gist), though EPSS remains very low at 0.03% (8th percentile), and no CISA KEV listing is present - indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

The affected product is a PHP-based point-of-sale and inventory management application distributed by SourceCodester (cpe:2.3:a:sourcecodester:simple_pos_and_inventory_system:*:*:*:*:*:*:*:*). The vulnerability resides in /admin/edit_customer.php, where user-supplied input to the ID argument is passed into a database query without adequate sanitization or parameterization - a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause. PHP applications using direct query construction without prepared statements are particularly prone to this class of flaw. The admin panel context suggests the vulnerable script performs a customer record lookup or update by ID, and unsanitized injection points in such operations can expose the underlying database to arbitrary query manipulation.

RemediationAI

No vendor-released patch has been identified at time of analysis. SourceCodester distributes this application as free source code without a formal patch lifecycle, so no upstream fix version is confirmed. The primary remediation is to replace direct SQL query construction with parameterized queries or prepared statements throughout the application, specifically in /admin/edit_customer.php where the ID parameter is processed. As a compensating control, restrict access to the /admin/ directory to trusted IP ranges via web server configuration (e.g., Apache .htaccess or nginx allow/deny directives) - this does not fix the injection but raises the bar by limiting who can reach the vulnerable endpoint. Enforce strong, unique credentials for all admin accounts and implement multi-factor authentication where feasible; since PR:H is required, hardening admin account security directly reduces exploitability. Deploying a web application firewall (WAF) with SQL injection signatures can detect and block common payloads, though bypass techniques exist and this should not be the sole control. Reference the VulDB advisory at https://vuldb.com/vuln/365427 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9446 for ongoing updates.