Is there a public PoC exploit available for EUVD-2026-58572?

Yes, a public proof-of-concept exploit is available for EUVD-2026-58572. Prioritise patching immediately. EPSS: 0.2%.

Air Cargo Management System EUVD-2026-58572

Q: What is the CVSS score of EUVD-2026-58572?

EUVD-2026-58572 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-19787 LOW

SQL Injection (CWE-89)

2026-08-14 VulDB

GHSA-q3jq-xjh7-vvhf

PHP SQLi Air Cargo Management System Sourcecodester

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network-reachable endpoint requires high-privilege authentication (PR:H); SQL injection yields limited read/write/availability impact on the application database only, with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:47 vuln.today

Severity Changed

Aug 14, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Aug 14, 2026 - 03:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

CVE Published

Aug 14, 2026 - 02:45 cve.org

LOW 2.0

DescriptionCVE.org

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Air Cargo Management System 1.0 exposes the /classes/Master.php?f=save_cargo_type endpoint to database manipulation via a crafted id argument. Exploitation requires high-privilege authenticated access (CVSS 4.0 PR:H), constraining the realistic attacker pool to compromised or shared administrator accounts. A public proof-of-concept is available on GitHub, confirmed by VulDB reporting; no patch has been identified at time of analysis.

Technical ContextAI

The affected component is a PHP web application endpoint, /classes/Master.php?f=save_cargo_type, part of SourceCodester's Air Cargo Management System - a PHP/MySQL open-source project. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause as dynamic SQL query construction using unvalidated user input in the id argument, a failure to apply parameterized queries or prepared statements. The CPE string cpe:2.3:a:sourcecodester:air_cargo_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the vulnerability to a specific version range - all available releases should be treated as affected. The attack vector is network-accessible (AV:N), consistent with a web application interface exposed over HTTP/HTTPS.

RemediationAI

No vendor-released patch has been identified at time of analysis. Organizations running this application should apply parameterized queries or prepared statements directly to the source code at /classes/Master.php in the save_cargo_type function, replacing any dynamic SQL string concatenation involving the id argument - this is the definitive fix and eliminates the root cause (CWE-89). As a compensating control, restrict access to the application's administrative interface to known-trusted IP ranges via firewall or web server ACL (e.g., Apache Require ip or nginx allow/deny directives); this directly addresses the authentication-required attack surface by limiting who can submit the malicious request, though it does not eliminate the vulnerability. Deploying a web application firewall (WAF) with SQL injection detection rules on the id parameter provides detection and blocking capability as an additional layer, with the trade-off that WAF bypass techniques exist for unsophisticated rule sets. Monitor the vendor site (https://www.sourcecodester.com/) and VulDB entry (https://vuldb.com/vuln/389747) for any updated release. The public PoC is documented at https://github.com/XijieBa/CVE/issues/2.