Online Clothing Store EUVD-2026-54564

Q: What is the CVSS score of EUVD-2026-54564?

EUVD-2026-54564 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-19229 MEDIUM

Information Exposure (CWE-200)

2026-08-07 cna@vuldb.com

GHSA-pqv7-r97g-wvjj

Information Disclosure

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Remote unauthenticated access with no complexity; impact is low confidentiality only, no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 18:30 vuln.today

DescriptionCVE.org

A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /_notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

File and directory information exposure in SourceCodester Online Clothing Store allows unauthenticated remote attackers to retrieve Dreamweaver metadata files from the publicly accessible /_notes/ directory. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or special preconditions are required. A publicly disclosed proof-of-concept exists (E:P), documented via a Medium article detailing directory listing and Dreamweaver metadata exposure; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Technical ContextAI

Adobe Dreamweaver, a legacy web development IDE, generates a /_notes/ subdirectory containing metadata files that annotate site structure, file comments, and development artifacts. When a Dreamweaver-developed application is deployed to a production web server without removing this directory, its contents become directly accessible via HTTP. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class: the application fails to restrict HTTP access to internal development artifacts. The affected product is SourceCodester Online Clothing Store, a PHP-based open-source demo application distributed via sourcecodester.com. No CPE string was provided in the input, so exact version pinning is not available from NVD data.

RemediationAI

The primary remediation is to remove the /_notes/ directory from all production web server deployments of the Online Clothing Store. If immediate removal is not possible, restrict HTTP access to this path at the web server level: in Apache, add a location block or .htaccess rule with 'Deny from all'; in nginx, add 'location /_notes/ { deny all; return 403; }'. Audit the full deployment for other common development artifact directories (.git, .svn, .DS_Store, Thumbs.db) and apply equivalent restrictions. No vendor-released patch or fixed version has been identified from the available references. The VulDB entry at https://vuldb.com/vuln/386993 and the public disclosure at https://medium.com/@hemantrajbhati5555/information-disclosure-via-exposed-dreamweaver-metadata-files-and-directory-listing-5651ebcaef97 should be monitored for vendor response. The trade-off of denying the directory is zero functional impact to end users, as /_notes/ serves no runtime application purpose.