What is the CVSS score of CVE-2026-36937?

CVE-2026-36937 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36937

EUVD-2026-22000 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

SQLi PHP

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:46 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 16:15 euvd

EUVD-2026-22000

Analysis Generated

Apr 13, 2026 - 16:15 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php.

AnalysisAI

SQL injection in Sourcecodester Online Resort Management System v1.0 allows authenticated high-privilege users to execute arbitrary SQL queries via the /orms/admin/reservations/view_details.php endpoint, resulting in limited information disclosure. The vulnerability requires administrative access and carries minimal real-world risk due to CVSS 2.7, EPSS 0.02% (6th percentile), and SSVC framework assessment indicating no active exploitation and non-automatable attack requirements.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) in a PHP-based web application, specifically in the admin interface of the Online Resort Management System. The flaw exists in the view_details.php script within the reservations module, suggesting inadequate input sanitization or parameterized query implementation when processing database queries. The CWE-89 classification confirms the root cause is improper neutralization of special elements in SQL commands, a decades-old vulnerability class typically arising from string concatenation rather than prepared statements. The affected product is identified via CPE but shows 'n/a' values, indicating the vulnerability database lacks standardized product identification data.

RemediationAI

Apply input validation and parameterized prepared statements (using PHP PDO or MySQLi prepared statements) to the /orms/admin/reservations/view_details.php endpoint to eliminate SQL injection. No vendor-released patch version is independently confirmed from available data; users should contact Sourcecodester directly or monitor the public GitHub bug report (https://github.com/huliangjia/bug_report/blob/main/Sourcecodester/online-resort-management-system/SQL-1.md) for remediation guidance. As a temporary workaround, restrict administrative access to trusted networks and implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns. The NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-36937) may be updated with patch availability information.