Is there a public PoC exploit available for EUVD-2026-43282?

Yes, a public proof-of-concept exploit is available for EUVD-2026-43282. Prioritise patching immediately. EPSS: 0.3%.

Online Book Store System EUVD-2026-43282

Q: What is the CVSS score of EUVD-2026-43282?

EUVD-2026-43282 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-15537 MEDIUM

SQL Injection (CWE-89)

2026-07-13 VulDB

GHSA-6hff-5fjr-6943

PHP SQLi Online Book Store System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Authentication bypass grants full admin access, warranting C:H and I:H; AV:N and PR:N confirmed by login-page pre-auth attack path.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 13, 2026 - 07:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 13, 2026 - 06:47 vuln.today

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Online Book Store System 1.0 exposes the admin authentication panel to remote, unauthenticated exploitation via the Username parameter in admin/login.php. A publicly available proof-of-concept - explicitly titled 'SQL Injection Leading to Authentication Bypass' - demonstrates that an attacker can bypass admin login entirely without valid credentials. No active exploitation is confirmed by CISA KEV, but the combination of a publicly released exploit and a trivially low attack complexity significantly elevates real-world risk above what the base CVSS 4.0 score of 6.9 suggests.

Technical ContextAI

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected component is admin/login.php in SourceCodester Online Book Store System 1.0, a PHP-based web application distributed as free educational source code. The Username parameter passed via an HTTP POST or GET request is concatenated directly into a SQL query without parameterization or sanitization, allowing an attacker to inject arbitrary SQL. The CPE string cpe:2.3:a:sourcecodester:online_book_store_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating all released versions are considered affected. Classic payloads such as ' OR '1'='1 inserted into the Username field cause the authentication query to return true unconditionally, bypassing credential checks entirely.

RemediationAI

No vendor-released patch has been identified at the time of analysis for SourceCodester Online Book Store System. SourceCodester does not typically issue formal security advisories. Developers who have deployed this application should immediately replace dynamic SQL string concatenation in admin/login.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions, which eliminates the injection surface entirely. As an interim measure, deploying a web application firewall (WAF) rule set targeting common SQL injection payloads can reduce exposure, though WAF bypass is possible for determined attackers and is not a substitute for code remediation. Restricting administrative panel access (admin/login.php) to trusted IP ranges via server or network ACLs significantly reduces the attack surface by removing unauthenticated internet-facing exposure. If the application is deployed in a production context, consider replacing it entirely with a maintained alternative, as SourceCodester code is intended for educational use and is not supported with security patches.