Is there a public PoC exploit available for EUVD-2026-41757?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41757. Prioritise patching immediately. EPSS: 0.2%.

Stumasy EUVD-2026-41757

Q: What is the CVSS score of EUVD-2026-41757?

EUVD-2026-41757 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-14751 LOW

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-jr9g-27g7-5w8x

PHP SQLi Stumasy Mjperpinosa

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible SQLi requiring a valid authenticated session (PR:L); partial C/I/A impact confined to the vulnerable system with no scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 05, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 14:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 05, 2026 - 13:47 vuln.today

DescriptionCVE.org

A weakness has been identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The impacted element is the function Notes_controller::search_scratch_data of the file application/PHP/objects/notes/search_scratch_data.php. This manipulation of the argument field_name causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in stumasy's notes search functionality exposes authenticated remote attackers to database manipulation via the unsanitized field_name parameter in Notes_controller::search_scratch_data. The affected PHP application by developer mjperpinosa has a publicly available proof-of-concept exploit filed as GitHub issue #7, and the maintainer has not responded to disclosure, leaving all users on any commit through 327d1b0f2915ba79d7ef8ebb74553e987609d9be without a remediation path. No public exploit identified at time of analysis meets the KEV threshold, but the confirmed POC and absence of vendor response meaningfully elevate operational risk.

Technical ContextAI

Stumasy is a PHP-based application by the developer mjperpinosa, identified by CPE cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command), a classic SQL injection pattern in which user-supplied input is incorporated into a database query without parameterization or escaping. The specific sink is the field_name argument processed by Notes_controller::search_scratch_data in application/PHP/objects/notes/search_scratch_data.php. The CVSS 4.0 vector includes an exploit maturity modifier of E:P, confirming the POC-available status at the time of scoring. The project uses a rolling release model with no versioned tags, making patch tracking dependent solely on commit hashes.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to responsible disclosure filed via GitHub issue #7. The definitive fix requires applying parameterized queries or prepared statements to the field_name input in application/PHP/objects/notes/search_scratch_data.php, eliminating the unsanitized concatenation into SQL. As an immediate compensating control, restrict access to the notes search endpoint to the minimum set of trusted authenticated users, or disable the feature entirely if not operationally required - this directly exploits the PR:L limiting factor. Deploying a web application firewall rule targeting SQL injection patterns at this endpoint can reduce automated exploitation risk, though WAF bypasses are possible with crafted payloads and should not be treated as a complete mitigation. Monitor the repository at https://github.com/mjperpinosa/stumasy/ for any upstream commits addressing the flaw.