SmartHomeAdatum EUVD-2026-43220

Q: What is the CVSS score of EUVD-2026-43220?

EUVD-2026-43220 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-15498 MEDIUM

SQL Injection (CWE-89)

2026-07-12 VulDB

GHSA-wc4j-x9hf-6mp5

PHP SQLi Smarthomeadatum

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-exposed unauthenticated login form drives PR:N and AV:N; SQL injection yields partial data read and write but no demonstrated availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 12:16 vuln.today

DescriptionCVE.org

A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users.php of the component Login. Such manipulation of the argument Login leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in SmartHomeAdatum's users.php Login component exposes the backend database to unauthenticated remote manipulation via a crafted Login argument. All commits up to cf495353d81b680675eb8d9aa14a318aa45ce12c of this PHP-based smart home application are affected, with no patch available and a vendor that did not respond to disclosure. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 vector confirms low-complexity unauthenticated network exploitation.

Technical ContextAI

SmartHomeAdatum is a PHP application for smart home management developed by sergomanov, identified by CPE cpe:2.3:a:sergomanov:smarthomeadatum:*:*:*:*:*:*:*:*. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates the Login parameter in users.php is concatenated directly into a SQL query without sanitization or parameterization, allowing an attacker to inject arbitrary SQL statements. The application operates on a rolling release model, so no discrete version numbers define the attack surface - any deployment at or before commit cf495353d81b680675eb8d9aa14a318aa45ce12c is affected. The vulnerability resides in the pre-authentication code path, making it accessible without any prior credential.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor was contacted prior to public disclosure but did not respond. Operators should immediately restrict network access to the users.php endpoint - for example, by placing the application behind an authenticated reverse proxy or VPN, so the Login form is not publicly reachable (trade-off: reduces usability for remote users). A web application firewall rule blocking common SQL metacharacter patterns in the Login parameter (single quotes, comment sequences, UNION keywords) provides a compensating control but may produce false positives on legitimate credentials containing special characters. The definitive fix requires replacing the vulnerable SQL string concatenation in users.php with parameterized queries or prepared statements using PDO or MySQLi; organizations with PHP development capability should apply this patch directly to their deployment. Database account privileges for the application should be reviewed and restricted to the minimum required (SELECT, INSERT on specific tables only), limiting the blast radius of any successful injection. See https://vuldb.com/vuln/377805 for additional disclosure context.