CVE-2026-5560
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A SQL injection vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1 in the file /payment-method.php. Manipulation of the paymethod argument allows remote attack. The exploit has been made public.
Risk Assessment
An attacker can remotely manipulate database queries, potentially leading to data leakage or modification.
Recommendation
Immediately update the system to the latest version or apply a patch to prevent SQL injection.
Original NVD description (English source)
A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /payment-method.php of the component Parameter Handler. Performing a manipulation of the argument paymethod results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.