Is there a public PoC exploit available for EUVD-2026-33628?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33628. Prioritise patching immediately. EPSS: 0.0%.

Online House Rental System EUVD-2026-33628

Q: What is the CVSS score of EUVD-2026-33628?

EUVD-2026-33628 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10252 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-25w2-8xxf-58fw

SQLi PHP Online House Rental System

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

MEDIUM 5.5

Severity Changed

Jun 01, 2026 - 13:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 13:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 13:15 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Online House Rental System 1.0. This affects an unknown function of the file /manage_tenant.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in itsourcecode Online House Rental System 1.0 allows remote unauthenticated attackers to manipulate the 'ID' parameter of /manage_tenant.php to inject arbitrary SQL queries against the backend database. Publicly available exploit code exists (disclosed via GitHub issue tracker and indexed by VulDB), making opportunistic exploitation feasible against any internet-exposed instance. The vulnerability impacts a PHP-based property management application typically deployed by small landlords or as a learning/demonstration project.

Technical ContextAI

The affected software is a PHP/MySQL web application (CPE cpe:2.3:a:itsourcecode:online_house_rental_system) from itsourcecode, a site that distributes open-source PHP projects often used as academic or starter codebases. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the 'ID' GET/POST parameter passed to /manage_tenant.php is concatenated directly into a SQL statement without parameterized queries or input sanitization. This is a classic pattern in PHP applications that use mysqli_query or mysql_query with string-interpolated user input rather than prepared statements with bound parameters.

RemediationAI

No vendor-released patch identified at time of analysis - itsourcecode has not published a fixed version through the provided references. The most effective remediation is to refactor /manage_tenant.php so that the 'ID' parameter is handled with prepared statements (mysqli_prepare with bound parameters or PDO with bindParam) and to cast the value to an integer before use if it is expected to be numeric. Until upstream fixes are released, compensating controls include placing the application behind a web application firewall with SQLi signatures tuned for the /manage_tenant.php endpoint (trade-off: WAF bypasses exist for tautology- and time-based payloads), restricting access to /manage_tenant.php by IP allowlist or VPN (trade-off: breaks remote tenant-management workflows), and granting the database account used by the PHP frontend only minimum SELECT/UPDATE privileges on the tenants table to limit blast radius from successful injection (trade-off: requires schema review and may break unrelated admin actions). Refer to the disclosure at https://vuldb.com/vuln/367530 and the public exploit details at https://github.com/zhengdexu-bot/zhengdexu/issues/4 for indicator matching.