What is the CVSS score of CVE-2026-36945?

CVE-2026-36945 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36945

EUVD-2026-21964 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

SQLi PHP

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:47 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 14:45 euvd

EUVD-2026-21964

Analysis Generated

Apr 13, 2026 - 14:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php

AnalysisAI

SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 allows authenticated administrators to execute arbitrary SQL queries via the /rsms/admin/clients/manage_client.php endpoint, potentially exposing sensitive data with low confidentiality impact. The vulnerability requires high-privilege administrator authentication and carries minimal real-world risk (EPSS 0.02%, SSVC indicates no exploitation activity), but represents a common code quality issue in open-source PHP applications that warrants remediation during security updates.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in PHP-based application code where user input is unsanitized and concatenated directly into SQL queries without prepared statements or parameterized query mechanisms. The affected endpoint /rsms/admin/clients/manage_client.php processes client data management operations within the administrative panel. Without proper input validation or use of parameterized queries (prepared statements with bound parameters), an attacker with administrative credentials can craft malicious SQL fragments that alter query logic, potentially extracting data from the underlying database. This type of flaw is preventable through standard secure coding practices: using parameterized prepared statements, input validation and type casting, and object-relational mapping (ORM) frameworks that abstract SQL construction.

RemediationAI

Apply the security patch by updating to a version of Computer and Mobile Repair Shop Management System that includes SQL injection remediation in manage_client.php. The primary fix involves replacing all unsanitized SQL query construction with prepared statements using parameterized queries (using mysqli prepared statements or PDO with bound parameters in PHP). Until patching is feasible, apply input validation and sanitization to the client management form fields, though this is a defense-in-depth measure and not a substitute for parameterized queries. Restrict administrative panel access via network firewall rules or VPN to trusted IP ranges, since exploitation requires administrative credentials. Consult the vulnerability report at https://vuldb.com/vuln/357165 and the GitHub disclosure at https://github.com/huliangjia/bug_report for technical details on the affected code path.