CVE-2026-5641

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/update-image1.php of the component Parameter Handler. The manipulation of the argument filename results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-564106.9xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.CVE-2026-564116.9xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.CVE-2026-564125.9libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls frCVE-2026-5641310.0Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by CVE-2026-564147.2A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content CVE-2026-5641510.0Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authenticatCVE-2026-564164.8In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFCVE-2026-56427.3A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknowCVE-2026-564229.4Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scoCVE-2026-564238.8MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelectiCVE-2026-564248.8MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownersCVE-2026-564258.8The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could
CVE-2026-5641: Medium severity, CVSS 6.3 | Vulnix