What is the CVSS score of CVE-2026-36872?

CVE-2026-36872 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36872

EUVD-2026-21910 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

GHSA-wrwp-9wcw-r8q6

SQLi PHP N A

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:47 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 12:45 euvd

EUVD-2026-21910

Analysis Generated

Apr 13, 2026 - 12:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php.

AnalysisAI

SQL injection in Sourcecodester Basic Library System v1.0 allows high-privilege authenticated attackers to extract limited information from the database via crafted input to /librarysystem/load_book.php. The vulnerability requires administrative credentials and has very low real-world risk (EPSS 0.02%, CVSS 2.7) with no public exploit code identified; CISA does not list it as actively exploited.

Technical ContextAI

Sourcecodester Basic Library System is a PHP-based web application for managing library operations. The vulnerability resides in load_book.php, which processes user input without proper parameterized query protection, allowing attackers to manipulate SQL statements. CWE-89 (SQL Injection) occurs when untrusted input is concatenated directly into SQL queries rather than using prepared statements or parameterized queries. The application's backend likely connects to a relational database (MySQL/MariaDB typical for PHP applications) where attackers can inject malicious SQL syntax to bypass authentication logic or extract data.

RemediationAI

Implement parameterized queries (prepared statements) in /librarysystem/load_book.php to prevent SQL injection. In PHP, use mysqli_prepare() with bind_param() or PDO prepared statements instead of string concatenation for SQL queries. Example: Replace $query = "SELECT * FROM books WHERE id = " . $_GET['id'] with $stmt = $conn->prepare("SELECT * FROM books WHERE id = ?"); $stmt->bind_param("i", $_GET['id']); $stmt->execute();. Additionally, validate and sanitize all user input using whitelisting and type-checking before database operations. Apply the latest patch version from the vendor if available; consult https://nvd.nist.gov/vuln/detail/CVE-2026-36872 and the GitHub advisory for specific patched release information. For legacy deployments unable to patch immediately, restrict access to /librarysystem/load_book.php via network-level controls or authentication rules to limit exposure to high-privilege users only.