CVE-2026-8131

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the file /admin/replymsg.php. The manipulation of the argument msgid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-813106.6Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is inCVE-2026-813157.4Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection CVE-2026-813162.1Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restricCVE-2026-813182.1Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate CVE-2026-813195.9Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted coluCVE-2026-81327.3A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /login.php. This manipuCVE-2026-813205.5A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the CVE-2026-813219.8CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesysteCVE-2026-813222.1Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error tCVE-2026-813266.8QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's clieCVE-2026-81337.3A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of tCVE-2026-813306.5The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits c
CVE-2026-8131: High severity, CVSS 7.3 | Vulnix