What is the CVSS score of CVE-2026-29861?

CVE-2026-29861 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-29861?

PHP-MYSQL-User-Login-System v1.0 contains a critical unauthenticated SQL injection vulnerability (CVSS 9.8) in the login mechanism that could allow attackers to bypass authentication and compromise…

How to fix or mitigate CVE-2026-29861?

Within 24 hours: Inventory all systems running PHP-MYSQL-User-Login-System v1.0 and assess business criticality. Within 7 days: If in use, implement network segmentation or WAF rules to restrict login.php access, enforce parameterized queries in application code, and apply input validation on the username parameter. Within 30 days: Plan remediation by upgrading to a maintained login framework or decommissioning the application if it is legacy/non-critical.

PHP CVE-2026-29861

EUVD-2026-21386 CRITICAL

SQL Injection (CWE-89)

2026-04-10 mitre

GHSA-g288-xp64-f3j7

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 15:24 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 10, 2026 - 15:15 euvd

EUVD-2026-21386

CVE Published

Apr 10, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php.

AnalysisAI

SQL injection in PHP-MYSQL-User-Login-System v1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the username parameter at login.php, potentially enabling complete database compromise, authentication bypass, and unauthorized administrative access. Publicly available exploit code exists (GitHub POC). Despite a critical CVSS score of 9.8, EPSS exploitation probability is extremely low (0.01%, 2nd percentile), and no confirmed active exploitation (not in CISA KEV). The low real-world exploitation signal suggests limited deployment or attacker interest in this specific application.

Technical ContextAI

This vulnerability affects PHP-MYSQL-User-Login-System version 1.0, a lightweight PHP-based authentication system. The flaw is a classic CWE-89 SQL injection in the authentication workflow at login.php, where user-supplied input from the username parameter is incorporated into SQL queries without proper sanitization, parameterization, or escaping. Attackers can manipulate the SQL query structure by injecting malicious SQL syntax through the username field. This enables arbitrary SQL command execution against the backend MySQL database, typical of applications that construct dynamic SQL queries using string concatenation rather than prepared statements. The vulnerability resides in the authentication layer, making it particularly severe as it bypasses the primary security control.

RemediationAI

No vendor-released patch has been identified at time of analysis, and the incomplete CPE data suggests no active vendor maintenance. Organizations using PHP-MYSQL-User-Login-System v1.0 should immediately discontinue use and migrate to a maintained authentication framework with built-in SQL injection protections. If immediate replacement is not feasible, implement emergency workarounds: refactor login.php to use parameterized prepared statements (PDO or MySQLi with bind parameters) for all database queries involving the username parameter, implement strict input validation with allowlisting for username format (alphanumeric characters only), and deploy web application firewall rules to detect and block SQL injection patterns. Review database access logs for suspicious authentication attempts or SQL error messages. For authoritative guidance, consult the GitHub repository referenced in the CVE (https://github.com/amanyadav78/CVE-2026-29861) and NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-29861), though these appear to document the vulnerability rather than provide vendor fixes.