Performance Indicator System EUVD-2026-93487

Exploitation requires the attacker to reach the admin-side script /opils/admin/view_product.php and supply a malicious 'Category' request argument against SourceCodester Performance Indicator System 1.0. The CVSS vector's PR:L indicates a low-privilege authenticated session is required, which is the primary limiting factor - this is not an unauthenticated internet-wide attack. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the attacker must first obtain valid (even low-privilege) credentials or an active session to the admin interface, and the target must be running the specific vulnerable 1.0 release.

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The CVSS 4.0 base score is 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N and only Low impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L), reflecting a SQL injection reachable over the network but requiring some level of authentication (PR:L) and yielding only partial impact. The E:P (Proof-of-Concept) threat metric aligns with the reported public exploit on GitHub - publicly available exploit code exists, but this is NOT the same as active exploitation; the CVE is not in CISA KEV. No EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified here. The signals are internally consistent (network vector, low complexity, PoC-stage maturity, authenticated access), so there is no major conflict to flag - the main caveat is that PR:L indicates an authenticated attacker is needed, which meaningfully narrows real-world risk versus an unauthenticated RCE. Priority should be modest and driven largely by the low real-world footprint of the affected product rather than by the vulnerability's technical characteristics.

An attacker with low-privileged access to the admin area submits a crafted value in the 'Category' argument when requesting /opils/admin/view_product.php, injecting SQL into the backend query. Because public exploit code already exists on GitHub, the barrier to reproduction is low, allowing the attacker to read or tamper with database contents to a limited degree. Network reachability (AV:N) with low complexity (AC:L) makes the request trivial to deliver once authenticated.