CVE-2026-5640

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.php of the component Parameter Handler. The manipulation of the argument filename leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-564009.6open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and autheCVE-2026-564026.5NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder CVE-2026-564036.9libexpat before 2.8.2 has an integer overflow in storeAtts.CVE-2026-564046.9libexpat before 2.8.2 has an integer overflow in addBinding.CVE-2026-564056.9libexpat before 2.8.2 has an integer overflow in getAttributeId.CVE-2026-564066.9libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.CVE-2026-564076.9libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.CVE-2026-564086.9libexpat before 2.8.2 has an integer overflow in copyString.CVE-2026-564096.5xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.CVE-2026-56416.3A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/uCVE-2026-564106.9xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.CVE-2026-564116.9xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-5640: Medium severity, CVSS 6.3 | Vulnix