CVE-2026-5641

CVE-2026-5641 is a SQL injection vulnerability affecting PHPGurukul Online Shopping Portal Project version 2.1, specifically in the /admin/update-image1.php file where the filename parameter is inadequately validated. This allows attackers to inject malicious SQL commands through the parameter handler component. The vulnerability carries a CVSS score of 6.3 (Medium severity) with a network-based attack vector requiring low complexity and authenticated access. Successful exploitation could result in unauthorized data disclosure, modification, and potential availability impacts, affecting the confidentiality, integrity, and availability of the affected system. Exploit code has been publicly disclosed; however, the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community engagement as indicated by its low EPSS score of 0.0003. The vulnerability remains in an inactive status on threat intelligence hot lists, suggesting limited active exploitation in the wild at this time, though organizations running vulnerable versions should still prioritize patching.