CVE-2026-8128: SourceCodester SUP Online Shopping viewmsg.php sql injection

Published May 8, 2026

Updated

A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.php. Performing a manipulation of the argument msgid results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Affected Software

1 affected component

Sourcecodester SUP Online Shopping=1.0

Event History

May 8, 2026

CVE Published

via MITRE·02:15 AM

Data Sourced

via MITRE·02:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeakness

Nov 17, 58336

Event

via FIRST·11:20 PM

Frequently Asked Questions

What is the severity of CVE-2026-8128?

CVE-2026-8128 has a high severity rating due to its potential for SQL injection vulnerabilities.

How do I fix CVE-2026-8128?

To fix CVE-2026-8128, you should sanitize and validate all input parameters, particularly the msgid parameter in the viewmsg.php file.

What software is affected by CVE-2026-8128?

CVE-2026-8128 affects version 1.0 of the SourceCodester SUP Online Shopping application.

Can CVE-2026-8128 lead to data breaches?

Yes, CVE-2026-8128 can potentially lead to data breaches through unauthorized access to the database via SQL injection.

Is there a patch available for CVE-2026-8128?

There is currently no official patch released for CVE-2026-8128; manual code updates are recommended.