CVE-2026-8130

HighCVSS 7.3/10Last modified Oct 26, 2026

Description

A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /admin/message.php. The manipulation of the argument seenid leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	SUP Online Shopping	1.0

References

Timeline

Published: May 8, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-813007.1Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.CVE-2026-813018.5Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller CVE-2026-813028.5PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code wi CVE-2026-813036.3A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spe CVE-2026-813056.8CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An atta CVE-2026-81317.3A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the file /admin/replymsg.CVE-2026-813106.6Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is in CVE-2026-813157.4Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection CVE-2026-813162.1Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restric CVE-2026-813182.1Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate CVE-2026-813195.9Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted colu CVE-2026-81327.3A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /login.php. This manipu