CVE-2026-8130 is a SQL injection vulnerability affecting SourceCodester SUP Online Shopping 1.0. The issue arises from improper sanitization of the 'seenid' parameter in the /admin/message.php file, allowing an unauthenticated remote attacker to inject SQL commands. This could potentially lead to unauthorized data access or manipulation. The vulnerability has a CVSS 4.0 score of 6.9, reflecting medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized disclosure, modification, or deletion of data. However, the impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. There are no confirmed reports of active exploitation in the wild.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to restrict access to the affected endpoint (/admin/message.php) to trusted users only and monitor for suspicious activity related to the 'seenid' parameter. Consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting this parameter.