What is the CVSS score of CVE-2026-36938?

CVE-2026-36938 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36938

EUVD-2026-22002 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

SQLi PHP

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:47 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 16:15 euvd

EUVD-2026-22002

Analysis Generated

Apr 13, 2026 - 16:15 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php.

AnalysisAI

SQL injection in Sourcecodester Online Resort Management System v1.0 allows high-privileged authenticated attackers to query the database with limited confidentiality impact via the /orms/admin/rooms/view_room.php endpoint. The CVSS score of 2.7 and EPSS percentile of 6% reflect low real-world exploitation probability; SSVC assessment confirms no known automated exploit path and only partial technical impact (information disclosure). No public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability exists in a PHP-based web application (Sourcecodester Online Resort Management System v1.0) that processes user-supplied input in the view_room.php administrative interface without proper parameterized query protection. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates the root cause is direct concatenation of unsanitized input into SQL statements. The affected endpoint is /orms/admin/rooms/view_room.php, which handles room data retrieval. An attacker with admin-level credentials (PR:H per CVSS) can manipulate SQL logic to extract unauthorized data from the database.

RemediationAI

Apply parameterized queries (prepared statements) to the /orms/admin/rooms/view_room.php endpoint to neutralize SQL injection. Replace all direct SQL concatenation with parameterized prepared statements using the PHP database abstraction layer (PDO or mysqli with bind parameters). Implement input validation and output encoding as defense-in-depth measures. Apply the most recent patched version released by Sourcecodester when available; consult https://nvd.nist.gov/vuln/detail/CVE-2026-36938 for vendor advisory links. If a patch is unavailable, restrict access to the admin interface via IP allowlisting and enforce multi-factor authentication for administrative accounts.