CVE-2026-5558
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In PHPGurukul Online Shopping Portal Project up to version 2.1, a SQL injection vulnerability was found in the file /pending-orders.php via manipulation of the ID argument. The attack can be performed remotely and the exploit has been published.
Risk Assessment
An attacker can gain unauthorized access to the order database, potentially leading to customer data theft or order modification.
Recommendation
Immediately implement parameterized SQL queries or prepared statements in pending-orders.php and restrict access to this file.
Other vulnerabilities in PHPGurukul Online Shopping Portal Project
See all- CVE-2026-5636Medium
SQL Injection vulnerability in PHPGurukul Online Shopping Portal Project 2.1. Unknown part of /cancelorder.php in Parameter Handler allows manipulation of oid argument, leading to SQL injection. Remote attack possible. Exploit published.
- CVE-2026-5635Medium
SQL Injection vulnerability in PHPGurukul Online Shopping Portal Project 2.1. Unknown functionality in /categorywise-products.php in Parameter Handler allows manipulation of cid argument, leading to SQL injection. Remote attack possible. Exploit published.
- CVE-2026-5583Medium
SQL Injection vulnerability in PHPGurukul Online Shopping Portal Project 2.1. Unknown part of /my-profile.php in Parameter Handler allows manipulation of fullname argument, leading to SQL injection. Remote attack possible. Exploit published.
Original NVD description (English source)
A flaw has been found in PHPGurukul PHPGurukul Online Shopping Portal Project up to 2.1. Impacted is an unknown function of the file /pending-orders.php of the component Parameter Handler. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS