What is the CVSS score of CVE-2026-36236?

CVE-2026-36236 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-36236?

SourceCodester Engineers Online Portal v1.0 contains an unauthenticated SQL injection vulnerability in password update functionality that could allow attackers to compromise the entire database,…

How to fix or mitigate CVE-2026-36236?

Within 24 hours: Identify all instances of SourceCodester Engineers Online Portal v1.0 in your environment and take the application offline or restrict network access to trusted IP ranges only. Within 7 days: Contact SourceCodester for patch availability and workaround guidance; implement Web Application Firewall (WAF) rules to block SQL injection patterns in the new_password parameter of update_password.php. Within 30 days: Evaluate migration to a patched version or alternative portal solution; conduct forensic review of database access logs for signs of exploitation.

PHP CVE-2026-36236

EUVD-2026-21392 CRITICAL

SQL Injection (CWE-89)

2026-04-10 mitre

GHSA-h5j3-w5wp-rcr7

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 15:25 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 10, 2026 - 15:15 euvd

EUVD-2026-21392

CVE Published

Apr 10, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

SourceCodester Engineers Online Portal v1.0 is vulnerable to SQL Injection in update_password.php via the new_password parameter.

AnalysisAI

SQL injection in SourceCodester Engineers Online Portal v1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands through the new_password parameter in update_password.php, enabling complete database compromise, authentication bypass, and potential server takeover. Despite a critical CVSS score of 9.8, EPSS indicates only 0.01% exploitation probability (2nd percentile), and no public exploit identified at time of analysis beyond technical documentation. The vulnerable PHP application lacks input validation on password update functionality, a common weakness in legacy web portals.

Technical ContextAI

This vulnerability affects SourceCodester Engineers Online Portal version 1.0, a PHP-based web application for managing engineering projects and personnel. The flaw is classified as CWE-89 (SQL Injection), occurring when the update_password.php script fails to properly sanitize or parameterize the new_password parameter before incorporating it into SQL queries. Classic SQL injection vulnerabilities arise when user-supplied input is concatenated directly into SQL statements rather than using prepared statements or parameterized queries. In PHP applications, this typically manifests through direct string concatenation with $_POST or $_GET variables passed to mysql_query() or mysqli_query() functions without proper escaping. The affected endpoint appears to be a password change function, which should be a privileged operation but may be exploitable without authentication if the PR:N (no privileges required) CVSS component is accurate. CPE data is generic (cpe:2.3:a:n/a:n/a), indicating limited vendor tracking in official databases.

RemediationAI

No vendor-released patch identified at time of analysis. SourceCodester Engineers Online Portal appears to be an unmaintained or community-supported project without active security updates. Organizations currently running version 1.0 should immediately implement the following measures: (1) Apply input validation and parameterized queries to update_password.php by replacing direct SQL concatenation with PHP PDO prepared statements or mysqli_prepare() with bound parameters for the new_password parameter. (2) Implement web application firewall (WAF) rules to detect and block SQL injection patterns targeting update_password.php endpoints. (3) Restrict access to password update functionality to authenticated sessions with proper CSRF protection. (4) If modification is not feasible, migrate to actively maintained alternatives with established security practices. (5) Conduct security audit of other PHP scripts in the application, as similar SQL injection vulnerabilities likely exist in other components following the same insecure coding patterns. Reference the technical analysis at https://github.com/Amorsec/CVE-PHP/blob/main/sourcecodester-Engineers_Online_Portal_in_PHP_update_password.php_sql_injection.pdf for specific code remediation guidance. Given the lack of vendor support, long-term solution is application replacement rather than patching.