Is there a public PoC exploit available for EUVD-2026-33633?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33633. Prioritise patching immediately. EPSS: 0.0%.

Pet Grooming Management Software EUVD-2026-33633

Q: What is the CVSS score of EUVD-2026-33633?

EUVD-2026-33633 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10254 MEDIUM

Insertion of Sensitive Information into Externally-Accessible File (CWE-538)

2026-06-01 VulDB

GHSA-fv4h-8p5m-3cg2

Information Disclosure Pet Grooming Management Software

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 01, 2026 - 13:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 13:17 vuln.today

DescriptionCVE.org

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/. This manipulation causes file and directory information exposure. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

File and directory information exposure in SourceCodester Pet Grooming Management Software 1.0 allows remote unauthenticated attackers to enumerate internal file and directory structures via the /admin/ endpoint. The root cause is CWE-538 (Deployment of Code to Unauthorized Actors / File and Directory Information Exposure), and a proof-of-concept exploit has been publicly released on GitHub. While not listed in CISA KEV and carrying only low confidentiality impact, the absence of any authentication requirement and the public POC lower the bar for exploitation significantly.

Technical ContextAI

SourceCodester Pet Grooming Management Software 1.0 is a PHP-based web application distributed freely for small business use. CWE-538 describes a condition where a web server or application inadvertently exposes internal file system structure - commonly through directory listing being enabled on the web server, verbose error messages revealing absolute paths, or an unprotected administrative endpoint returning file metadata. The affected path is /admin/, which is the application's administrative interface. Per CPE cpe:2.3:a:sourcecodester:pet_grooming_management_software:*:*:*:*:*:*:*:*, the wildcard version field indicates the flaw may not be limited to version 1.0 alone, though the CVE description specifically names 1.0. Exposure of /admin/ directory contents can reveal configuration file names, upload directories, database connection scripts, and backup files that enable follow-on attacks.

RemediationAI

No vendor-released patch has been identified at time of analysis; the remediation level in the CVSS temporal vector is marked RL:X (not defined), and no fix version appears in any of the provided references. Immediate compensating controls should be applied: configure the web server (Apache or nginx) to explicitly disable directory listing for the /admin/ path by setting 'Options -Indexes' in Apache or 'autoindex off' in nginx - this eliminates the most direct exposure. Restrict access to the /admin/ path to trusted IP ranges via web server or firewall ACLs, since PR:N (no authentication required) makes this the highest-priority control; trade-off is operational inconvenience for remote administrators. If the application supports it, enforce HTTP authentication (e.g., HTTP Basic Auth at the web server level) as an additional layer in front of /admin/. Monitor web server access logs for unusual enumeration patterns against /admin/. The exploit POC is publicly documented at https://github.com/MICHEY-Ben/cve/issues/2 and the VulDB entry at https://vuldb.com/vuln/367532 - review these for specific request patterns to inform WAF rule creation.