What is the CVSS score of CVE-2026-36920?

CVE-2026-36920 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36920

EUVD-2026-21920 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

SQLi PHP N A

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:47 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 13:15 euvd

EUVD-2026-21920

Analysis Generated

Apr 13, 2026 - 13:15 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions-view.php.

AnalysisAI

SQL injection in Sourcecodester Online Reviewer System v1.0 allows high-privileged authenticated users to extract limited data via a crafted SQL query in the questions-view.php endpoint. The vulnerability requires administrator-level credentials and lacks evidence of active exploitation or public exploit tooling, resulting in a minimal real-world risk profile despite confirmed SQL injection capability.

Technical ContextAI

The vulnerability exists in the PHP-based Online Reviewer System, specifically within the /system/system/admins/assessments/examproper/questions-view.php file, where user-supplied input is incorporated into SQL queries without proper parameterization or prepared statements (CWE-89: SQL Injection). The affected endpoint processes assessment question data and fails to sanitize or bind variables before database interaction, allowing an authenticated administrator to inject arbitrary SQL commands. This is a classic unsafe dynamic SQL construction pattern commonly found in legacy PHP applications that concatenate user input directly into SQL strings rather than using parameterized queries or ORM layers.

RemediationAI

The primary fix is to upgrade or patch the affected version; however, no official patched version has been confirmed by the vendor at time of analysis. As an immediate mitigation, implement parameterized queries or prepared statements (using mysqli prepared statements or PDO with bound parameters) for all database interactions in questions-view.php and throughout the application. Apply strict input validation, use an ORM framework to abstract SQL generation, and enforce least-privilege database accounts (separate read-only roles for question retrieval if feasible). Restrict administrative access to trusted networks via network segmentation or VPN. Consult the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-36920 for any updated guidance. Code-level review of all SQL construction patterns in the /system/ directory is strongly recommended given the legacy nature of the application.