{"id":"CVE-2026-19903","state":"PUBLISHED","title":"SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access","description":"A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.","publishedAt":"2026-08-15T17:45:07.886Z","updatedAt":"2026-08-17T15:45:33.120Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Online Clothing Store"],"affected":[{"vendor":"SourceCodester","product":"Online Clothing Store","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:online_clothing_store:*:*:*:*:*:*:*:*"],"modules":["SQL Database Backup"]}],"references":["https://vuldb.com/vuln/390096","https://vuldb.com/vuln/390096/cti","https://vuldb.com/cve/CVE-2026-19903","https://vuldb.com/submit/870782","https://medium.com/@hemantrajbhati5555/sensitive-information-disclosure-via-publicly-accessible-sql-backup-leading-to-administrative-50bac3a307aa","https://www.sourcecodester.com/"],"weaknesses":["CWE-552","CWE-425"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19903.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19903","state":"PUBLISHED","datePublished":"2026-08-15T17:45:07.886Z","dateUpdated":"2026-08-17T15:45:33.120Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-14T19:24:14.926Z"},"containers":{"cna":{"title":"SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access","descriptions":[{"lang":"en","value":"A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used."}],"affected":[{"vendor":"SourceCodester","product":"Online Clothing Store","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:online_clothing_store:*:*:*:*:*:*:*:*"],"modules":["SQL Database Backup"]}],"references":[{"url":"https://vuldb.com/vuln/390096","name":"VDB-390096 | SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/390096/cti","name":"VDB-390096 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-19903","name":"CVE-2026-19903 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/870782","name":"Submit #870782 | SourceCodester Online Clothing Store 1.0 Sensitive Information Disclosure","tags":["third-party-advisory"]},{"url":"https://medium.com/@hemantrajbhati5555/sensitive-information-disclosure-via-publicly-accessible-sql-backup-leading-to-administrative-50bac3a307aa","tags":["broken-link","exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-552","type":"CWE","lang":"en","description":"Files or Directories Accessible"}]},{"descriptions":[{"cweId":"CWE-425","type":"CWE","lang":"en","description":"Direct Request"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-15T17:45:07.886Z"},"timeline":[{"time":"2026-08-14T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-14T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-14T21:32:08.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Hemant Raj Bhati (VulDB User)","type":"reporter"}],"tags":["x_freeware"],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://medium.com/@hemantrajbhati5555/sensitive-information-disclosure-via-publicly-accessible-sql-backup-leading-to-administrative-50bac3a307aa","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-17T15:44:42.799446Z","id":"CVE-2026-19903","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-17T15:45:33.120Z"}}]}}}