Is there a public PoC exploit available for EUVD-2026-31999?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31999. Prioritise patching immediately. EPSS: 0.0%.

CET Grading System EUVD-2026-31999

Q: What is the CVSS score of EUVD-2026-31999?

EUVD-2026-31999 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9583 LOW

Information Exposure (CWE-200)

2026-05-26 cna@vuldb.com

GHSA-3826-wfx9-8758

Information Disclosure PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 26, 2026 - 21:30 vuln.today

DescriptionCVE.org

A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This impacts an unknown function of the file /index.php of the component SQL Handler. Executing a manipulation can lead to information exposure through error message. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Information exposure via verbose SQL error messages in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 enables authenticated remote attackers to harvest internal database details by manipulating the /index.php SQL Handler endpoint. The application returns raw SQL error output rather than sanitized application-level messages, leaking schema structure, table names, or query internals. A public proof-of-concept exploit is available on GitHub; this CVE is not listed in the CISA KEV catalog, and the CVSS 4.0 score of 2.1 reflects the low-severity, confidentiality-only impact.

Technical ContextAI

The affected product is a PHP-based academic grading application (SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0) distributed via sourcecodester.com. The vulnerable entry point is /index.php within its SQL Handler component, which processes database interactions without adequate exception handling. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as improper error suppression - raw SQL engine errors are propagated directly into HTTP responses rather than being caught and replaced with generic messages. This is a classic PHP misconfiguration pattern where display_errors is effectively enabled at the application layer or database exceptions are uncaught, causing the server to expose internal query context to any caller who triggers an error condition. No CPE string was included in the provided intelligence data.

RemediationAI

No vendor-released patch has been identified at time of analysis; the SourceCodester reference points only to the vendor homepage with no dedicated advisory. Immediate compensating controls include disabling verbose PHP error output by setting display_errors = Off and log_errors = On in php.ini, redirecting errors to server-side logs rather than HTTP responses - this directly eliminates the disclosure vector with no functional trade-off. Additionally, implement structured exception handling (try/catch blocks) around all database calls in /index.php to ensure SQL exceptions are caught and replaced with generic error messages before being returned to clients. Restrict access to /index.php to authenticated and appropriately authorized user roles at the application or web server layer. Consider deploying a WAF rule to detect responses containing SQL error strings (e.g., 'You have an error in your SQL syntax'). Monitor https://vuldb.com/vuln/365639 and https://www.sourcecodester.com/ for patch availability. The public PoC is documented at https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9583-Information-Disclosure/Advisory.md.