Is there a public PoC exploit available for EUVD-2026-54523?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54523. Prioritise patching immediately. EPSS: 0.3%.

Photo Share Website EUVD-2026-54523

Q: What is the CVSS score of EUVD-2026-54523?

EUVD-2026-54523 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-19211 MEDIUM

SQL Injection (CWE-89)

2026-08-07 VulDB

GHSA-37wh-mr6j-jq3m

PHP SQLi Photo Share Website Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Unauthenticated public signup endpoint reachable over the network; no complexity or privileges; partial database impact across all three dimensions with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 07, 2026 - 17:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 07, 2026 - 16:51 vuln.today

CVE Published

Aug 07, 2026 - 16:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Photo Share Website 1.0 exposes the unauthenticated user registration endpoint (/social/ajax.php?action=signup) to database manipulation via the email parameter. The CVSS 4.0 vector confirms network-exploitable with no authentication, no complexity, and no special attack conditions, while the E:P modifier reflects publicly available exploit code hosted on GitHub. No active exploitation is confirmed in CISA KEV, but the combination of a zero-barrier attack surface and public POC code means any internet-exposed instance should be treated as immediately at risk.

Technical ContextAI

The vulnerability is a classic SQL Injection (CWE-89) within a PHP web application. The signup handler in /social/ajax.php accepts an email parameter that is concatenated directly into a backend SQL query without parameterization or sanitization, allowing an attacker to alter query logic. The affected product is identified by CPE cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:*, distributed by SourceCodester - a platform that publishes open-source PHP applications primarily as academic and learning projects. The wildcard version in the CPE indicates no specific upper bound has been confirmed, suggesting all distributed releases may carry the flaw.

RemediationAI

No vendor-released patch has been identified at time of analysis for SourceCodester Photo Share Website 1.0; given the educational distribution model, an official patch may not be forthcoming. The primary fix is to rewrite the email parameter handling in /social/ajax.php to use parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), replacing any direct string interpolation. As an immediate compensating control, restrict or disable public access to the /social/ajax.php?action=signup endpoint via web server configuration (e.g., Apache .htaccess or nginx location block) if public self-registration is not required - note this will break signup functionality. Deploying a WAF rule to detect SQL metacharacters (single quotes, UNION, comment sequences) in POST body parameters provides a secondary layer but can produce false positives on legitimate email addresses containing special characters. If this application is serving production data, migration to a maintained alternative is strongly recommended. VulDB advisory: https://vuldb.com/vuln/386956.