HOMEVULNERABILITIESCVE-2026-37149
HIGH

CVE-2026-37149

Published: June 25, 2026· Updated: Jun 26, 2026

7.7
CVSS v3.1
EPSS:0.21%probability of exploitation in 30 daysPercentile:11.9th

Official Description

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

NVD Source

Technical Analysis

CVE-2026-37149 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 7.7.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Vendors & Products

Mentioned vendors (from description):
PHP
CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

All References (3)

→
https://github.com/anirudhkannanvp/GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN-
→
https://github.com/pateldhyeyit/CVE-2026-37149
→
https://owasp.org/www-community/attacks/SQL_Injection

Quick Facts

CVE IDCVE-2026-37149
CVSS Score7.7 / 10
SeverityHIGH
CISA KEVNo
EPSS (30d)0.21%
PublishedJun 25, 2026

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2026-37149 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2026-37149·NVD