CVE-2026-8128
HighSummary
A vulnerability was found in SourceCodester SUP Online Shopping 1.0 that allows SQL injection through manipulation of the msgid argument in the /admin/viewmsg.php file. The attack can be carried out remotely.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the database and leakage of sensitive information, posing a serious threat to the organization's security.
Recommendation
It is recommended to immediately update the system to the latest version and implement input data filtering to prevent SQL injection attacks.
Other vulnerabilities in SourceCodester SUP Online Shopping 1.0
See all- CVE-2026-8131High
A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0, affecting an unknown function of the file /admin/replymsg.php. Manipulation of the argument msgid results in SQL injection.
- CVE-2026-8130High
A vulnerability was identified in SourceCodester SUP Online Shopping 1.0, affecting an unknown function of the file /admin/message.php. The manipulation of the argument seenid leads to SQL injection.
- CVE-2026-8129High
A vulnerability was identified in SourceCodester SUP Online Shopping version 1.0, affecting an unknown function in the wishlist.php file. Manipulating the delwlistid argument can lead to SQL injection.
Original NVD description (English source)
A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.php. Performing a manipulation of the argument msgid results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.