Is there a public PoC exploit available for EUVD-2026-31958?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31958. Prioritise patching immediately. EPSS: 0.0%.

Student Transcript System EUVD-2026-31958

Q: What is the CVSS score of EUVD-2026-31958?

EUVD-2026-31958 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9573 MEDIUM

SQL Injection (CWE-89)

2026-05-26 VulDB

GHSA-38vh-6x94-qmj8

PHP SQLi Student Transcript Processing System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:17 vuln.today

Severity Changed

May 26, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was detected in itsourcecode Student Transcript Processing System 1.0. This affects an unknown part of the file /admin/modules/student/index.php?view=view. Performing a manipulation of the argument studentId results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Student Transcript Processing System 1.0 exposes the application to unauthenticated remote database manipulation via the studentId parameter in the admin student view endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no privileges or user interaction are required, and publicly available exploit code exists on GitHub. Despite the remote, unauthenticated attack surface and POC availability, EPSS sits at only 0.03% (9th percentile), indicating limited real-world exploitation uptake at time of analysis; no CISA KEV listing has been issued.

Technical ContextAI

The affected application is a PHP-based web system for processing student academic transcripts, as indicated by the PHP tag and CPE string cpe:2.3:a:itsourcecode:student_transcript_processing_system:*:*:*:*:*:*:*:*. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause: user-supplied input from the 'studentId' GET or POST parameter is passed directly into a SQL query without adequate parameterization or sanitization within the /admin/modules/student/index.php?view=view endpoint. This pattern is common in small PHP applications that use legacy string-concatenation query construction rather than prepared statements with bound parameters. The /admin/ path prefix suggests this endpoint is part of an administrative interface, though the CVSS PR:N vector indicates no authentication barrier was confirmed during scoring.

RemediationAI

No vendor-released patch has been identified at time of analysis - no patched version number appears in any reference, and itsourcecode.com provides no security advisory. The primary remediation is to replace string-concatenated SQL queries with parameterized queries or prepared statements throughout the application, specifically in the student module handling the studentId parameter. As an immediate compensating control, deploying a Web Application Firewall (WAF) rule to detect and block SQL injection payloads targeting the /admin/modules/student/index.php endpoint can reduce exposure, though WAF bypass remains possible with obfuscation. Access to the /admin/ path should be restricted to trusted IP ranges or internal networks only - if the admin panel is internet-facing, that exposure should be eliminated regardless of this CVE. Input validation enforcing that studentId is strictly numeric can serve as a lightweight defense-in-depth measure. Monitor VulDB entry https://vuldb.com/vuln/365632 and itsourcecode.com for any official patch release.