Which versions of PHP are affected by CVE-2026-3068?

A critical SQL injection vulnerability (CVE-2026-3068) affects our Document Management System versions up to 1.0, allowing attackers to compromise data confidentiality and integrity.

Is there a public PoC exploit available for CVE-2026-3068?

Yes, a public proof-of-concept exploit is available for CVE-2026-3068. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3068?

Within 24 hours: Isolate affected DMS instances from production networks if possible, disable public internet access, and activate enhanced logging/monitoring for suspicious database queries. Within 7 days: Implement WAF rules blocking common SQL injection patterns, restrict DMS access to authorized users only via network controls, and conduct urgent assessment of exposed data. Within 30 days: Evaluate upgrade to patched versions when available, deploy database activity monitoring, implement input validation/parameterized queries at application layer, and consider replacement with alternative solutions if vendor patch timeline is unacceptable.

PHP CVE-2026-3068

Q: What is the CVSS score of CVE-2026-3068?

CVE-2026-3068 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-02-24 cna@vuldb.com

PHP SQLi Document Management System Admerc

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 24, 2026 - 21:04 vuln.today

Public exploit code

CVE Published

Feb 24, 2026 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulation of the argument user2del can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Document Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).

Technical ContextAI

affects Document Management System. A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulation of the argument user2del can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.