{"id":"CVE-2026-37149","aliases":["EUVD-2026-39617","GHSA-jmpp-r595-xrp4"],"status":"published","title":"GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a...","description":"GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00217,"percentile":0.12244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2026-06-25T00:00:00Z","modified":"2026-06-26T15:33:15Z","exploits":[{"source":"pocgithub","id":"pateldhyeyit/CVE-2026-37149","title":"pateldhyeyit/CVE-2026-37149","date":"2026-06-20","url":"https://github.com/pateldhyeyit/CVE-2026-37149"}],"references":[{"url":"https://owasp.org/www-community/attacks/SQL_Injection"},{"url":"https://github.com/pateldhyeyit/CVE-2026-37149"},{"url":"https://github.com/anirudhkannanvp/GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN-"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37149"},{"url":"https://github.com/advisories/GHSA-jmpp-r595-xrp4"}],"sources":{"cve":[{"id":"CVE-2026-37149","description":"GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T14:14:25.636Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-39617","description":"GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T14:14:25Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:24.495602Z"}],"ghsa":[{"id":"GHSA-jmpp-r595-xrp4","title":"GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a...","description":"GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.","status":"published","published":"2026-06-25T21:31:31Z","modified":"2026-06-26T15:33:15Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:09:01.181648Z"}],"nvd":[{"id":"CVE-2026-37149","description":"GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.","status":"published","published":"2026-06-25T20:17:11.473Z","modified":"2026-06-26T15:16:37.8Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:26.045561Z"}]}}