What is the CVSS score of CVE-2026-36232?

CVE-2026-36232 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-36232?

CVE-2026-36232 is a critical SQL injection vulnerability in itsourcecode Online Student Enrollment System v1.0 that permits unauthenticated attackers to directly access, modify, or delete student and…

How to fix or mitigate CVE-2026-36232?

Within 24 hours: Identify all systems running itsourcecode Online Student Enrollment System v1.0 and isolate them from production networks or disable public access to instructorClasses.php. Within 7 days: Contact itsourcecode vendor for patch timeline and interim security releases; implement Web Application Firewall rules to block SQL injection patterns targeting the classId parameter. Within 30 days: Upgrade to a patched version when released by the vendor, or migrate to an alternative enrollment system if no patch is available within 60 days; conduct database integrity audit for unauthorized modifications.

PHP CVE-2026-36232

EUVD-2026-21390 CRITICAL

SQL Injection (CWE-89)

2026-04-10 mitre

GHSA-4xpm-h4rq-mjc8

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 15:24 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 10, 2026 - 15:15 euvd

EUVD-2026-21390

CVE Published

Apr 10, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'classId' parameter from $_GET['classId'] is directly concatenated into the SQL query without any sanitization or validation.

AnalysisAI

SQL injection in itsourcecode Online Student Enrollment System v1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via unsanitized classId parameter in instructorClasses.php. Despite critical CVSS 9.8 rating, EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity. Public proof-of-concept documentation exists on GitHub, lowering exploitation barrier for opportunistic attackers targeting educational institutions using this enrollment platform.

Technical ContextAI

This vulnerability exemplifies classic SQL injection (CWE-89) in PHP web applications where user-controlled input from HTTP GET parameters is directly concatenated into SQL query strings without parameterized queries or input validation. The instructorClasses.php endpoint accepts a classId parameter via $_GET['classId'] and embeds it raw into database queries, enabling attackers to inject arbitrary SQL commands. PHP's legacy database interaction patterns (mysql_query, mysqli without prepared statements) frequently produce this vulnerability class. The Online Student Enrollment System appears to be a classroom/educational management application handling sensitive student records, instructor assignments, and course data, making database compromise particularly impactful for academic institutions.

RemediationAI

Primary mitigation requires replacing vulnerable SQL query construction with parameterized prepared statements using PHP PDO or mysqli::prepare() methods to prevent SQL injection. Organizations running Online Student Enrollment System v1.0 should immediately implement input validation and sanitization for the classId parameter, wrapping all user input in mysqli_real_escape_string() as temporary workaround, though prepared statements remain the only secure long-term solution. No vendor-released patch identified at time of analysis - affected users must apply code-level fixes manually. Review all PHP files for similar unsanitized GET/POST parameter usage patterns. Consider web application firewall rules blocking SQL metacharacters in classId parameter until code remediation completes. Technical advisory available at https://nvd.nist.gov/vuln/detail/CVE-2026-36232 with proof-of-concept details at https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_instructorClasses.php_sql_injection.pdf.