What is the CVSS score of CVE-2026-36946?

CVE-2026-36946 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36946

EUVD-2026-21966 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

SQLi PHP

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:47 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 13:45 euvd

EUVD-2026-21966

Analysis Generated

Apr 13, 2026 - 13:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php.

AnalysisAI

SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 at /rsms/admin/inquiries/view_details.php allows high-privileged authenticated administrators to extract limited data via crafted SQL queries. The vulnerability requires admin-level access and produces only confidentiality impact with minimal real-world exploitation likelihood (EPSS 0.02%, CVSS 2.7, SSVC framework indicates no practical exploitation path).

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based management system. The vulnerable endpoint /rsms/admin/inquiries/view_details.php fails to properly sanitize or parameterize user input before constructing SQL queries. SQL injection occurs when untrusted input is concatenated directly into SQL statements, allowing attackers to modify query logic. In this case, the PHP application processes data through the admin inquiries module without adequate prepared statements or input validation, enabling an authenticated administrator to inject arbitrary SQL syntax to bypass intended query constraints and access unauthorized data.

RemediationAI

Implement parameterized SQL queries (prepared statements with placeholders) in /rsms/admin/inquiries/view_details.php to eliminate SQL injection. Replace all string concatenation in SQL construction with vendor-specific prepared statement syntax (mysqli prepared statements for PHP-MySQLi or PDO parameterized queries for database-agnostic code). Apply input validation to whitelist expected parameter formats and lengths. If an official patch is released by the vendor, upgrade to the patched version immediately. Until patching, restrict admin console access via network-level controls (IP whitelisting, VPN-only access) and enable comprehensive audit logging of all admin inquiries module activity to detect suspicious SQL patterns. Review the GitHub vulnerability report (https://github.com/huliangjia/bug_report/blob/main/Sourcecodester/computer-and-mobile-repair-shop-management-system/SQL-4.md) for technical details and proof-of-concept examples to validate remediation effectiveness.