What is the CVSS score of CVE-2026-36942?

CVE-2026-36942 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36942

EUVD-2026-21958 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

GHSA-7g9v-cc93-2w5g

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:47 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 14:45 euvd

EUVD-2026-21958

Analysis Generated

Apr 13, 2026 - 14:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php.

AnalysisAI

SQL injection in Sourcecodester Online Resort Management System v1.0 allows high-privilege authenticated attackers to read sensitive application data via crafted input to the /orms/admin/activities/manage_activity.php endpoint. The vulnerability requires administrator-level credentials and produces only confidentiality impact with negligible real-world exploitation risk, as indicated by 0.02% EPSS score and CISA SSVC partial technical impact assessment.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE category) in a PHP-based web application. The flaw exists in the manage_activity.php file within the admin panel of the resort management system, where user-supplied input from the activities management interface is concatenated directly into SQL queries without parameterization or prepared statements. This PHP application uses a direct database query mechanism vulnerable to SQL injection attacks. The attack surface is limited to the administrative interface (/orms/admin/activities/), which restricts exposure to authenticated administrators only.

RemediationAI

Sourcecodester has not released a patched version at time of analysis. The primary remediation is to implement parameterized queries or prepared statements in the manage_activity.php file to prevent SQL injection. Immediate workarounds include restricting administrative access via network segmentation, enforcing strong authentication on admin accounts, and implementing Web Application Firewall (WAF) rules to block SQL injection payloads targeting the /orms/admin/activities/ path. If upgrading is not possible, validate and sanitize all user inputs destined for SQL queries and use stored procedures with bound parameters. Refer to the vendor advisory links at https://nvd.nist.gov/vuln/detail/CVE-2026-36942 and VulDB for further guidance.