{"id":"CVE-2026-5583","state":"PUBLISHED","title":"PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection","description":"A security vulnerability has been detected in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /my-profile.php of the component Parameter Handler. The manipulation of the argument fullname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.","publishedAt":"2026-04-05T16:30:12.753Z","updatedAt":"2026-04-06T15:26:00.954Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["PHPGurukul Online Shopping Portal Project"],"affected":[{"vendor":"PHPGurukul","product":"Online Shopping Portal Project","versions":[{"version":"2.1","status":"affected"}],"cpes":["cpe:2.3:a:phpgurukul:online_shopping_portal_project:*:*:*:*:*:*:*:*"],"modules":["Parameter Handler"]}],"references":["https://vuldb.com/vuln/355380","https://vuldb.com/vuln/355380/cti","https://vuldb.com/submit/784087","https://github.com/f1rstb100d/CVE/issues/14","https://phpgurukul.com/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5583.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5583","state":"PUBLISHED","datePublished":"2026-04-05T16:30:12.753Z","dateUpdated":"2026-04-06T15:26:00.954Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-04-04T18:44:47.752Z"},"containers":{"cna":{"title":"PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /my-profile.php of the component Parameter Handler. The manipulation of the argument fullname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used."}],"affected":[{"vendor":"PHPGurukul","product":"Online Shopping Portal Project","versions":[{"version":"2.1","status":"affected"}],"cpes":["cpe:2.3:a:phpgurukul:online_shopping_portal_project:*:*:*:*:*:*:*:*"],"modules":["Parameter Handler"]}],"references":[{"url":"https://vuldb.com/vuln/355380","name":"VDB-355380 | PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/355380/cti","name":"VDB-355380 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/784087","name":"Submit #784087 | PHPGurukul Online Shopping Portal Project 2.1 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/f1rstb100d/CVE/issues/14","tags":["exploit","issue-tracking"]},{"url":"https://phpgurukul.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-04-05T16:30:12.753Z"},"timeline":[{"time":"2026-04-04T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-04-04T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-04-04T20:49:52.000Z","lang":"en","value":"VulDB entry last update"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-06T15:25:52.461258Z","id":"CVE-2026-5583","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-06T15:26:00.954Z"}}]}}}