What is the CVSS score of CVE-2026-36944?

CVE-2026-36944 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36944

EUVD-2026-21962 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

SQLi PHP

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:46 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 14:45 euvd

EUVD-2026-21962

Analysis Generated

Apr 13, 2026 - 14:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php.

AnalysisAI

SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 allows authenticated high-privilege users to read sensitive database content via crafted input in the repairs details viewer. The vulnerability requires admin-level authentication and carries minimal real-world risk given the CVSS 2.7 score, EPSS 0.02% exploitation probability, and CISA SSVC assessment indicating no known exploitation, non-automatable attack, and only partial technical impact (confidentiality). No active exploitation has been confirmed.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) in the PHP application file /rsms/admin/repairs/view_details.php, where user-supplied input is concatenated into SQL queries without parameterized statements or input validation. SQL injection occurs when an attacker manipulates query syntax by injecting SQL metacharacters and logic, allowing unauthorized query modification. In this case, the attack surface is limited to authenticated administrators, reducing the practical attack surface significantly. The underlying root cause is the failure to use prepared statements or parameterized queries in the PHP backend, a foundational secure coding practice for preventing SQL injection across all database-backed web applications.

RemediationAI

Implement parameterized prepared statements (prepared query parameters) in the repairs details viewer, replacing all string concatenation in SQL queries with bound parameters. In PHP, use mysqli prepared statements with the '?' or named parameter placeholders, or upgrade to use parameterized query frameworks. Developers should immediately audit all other admin-facing PHP files in the /rsms directory for similar SQL injection patterns and apply the same remediation. Apply input validation and whitelist-based filtering as a secondary defense layer. No vendor-released patch version is currently confirmed; contact Sourcecodester for security update availability or review the GitHub advisory at https://github.com/huliangjia/bug_report/blob/main/Sourcecodester/computer-and-mobile-repair-shop-management-system/SQL-1.md for proof-of-concept details and remediation guidance.