What is the CVSS score of CVE-2026-36947?

CVE-2026-36947 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36947

EUVD-2026-21968 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

SQLi PHP N A

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:47 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 13:45 euvd

EUVD-2026-21968

Analysis Generated

Apr 13, 2026 - 13:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_service.php.

AnalysisAI

SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 at /rsms/admin/services/view_service.php allows authenticated administrators to extract sensitive database information with low complexity. The vulnerability requires high-privilege (admin) access and does not enable data modification or denial of service, limiting real-world impact despite the unauthenticated attack vector network availability. No active exploitation or public proof-of-concept tools have been confirmed; EPSS score of 0.02% and SSVC framework rating 'none' exploitation status indicate minimal practical risk despite CVSS 2.7 rating.

Technical ContextAI

The vulnerability exists in a PHP-based web application using MySQL or similar SQL database backend. The SQL injection flaw (CWE-89) occurs in the view_service.php administrative endpoint, likely in query construction where user-controlled input from request parameters is concatenated directly into SQL statements without parameterized queries or input sanitization. The network attack vector indicates HTTP/HTTPS accessibility, but the requirement for PR:H (high privileges/admin authentication) means the application implements some access control that restricts the vulnerable endpoint to authenticated administrator accounts. The partial confidentiality impact (C:L) reflects database information disclosure; absence of integrity and availability impact (I:N, A:N) indicates no write or crash capability.

RemediationAI

Upgrade Sourcecodester Computer and Mobile Repair Shop Management System to a patched version released after this disclosure (exact patch version not provided in available sources). As an interim control, restrict HTTP/HTTPS access to /rsms/admin/ endpoints to a whitelist of trusted administrator IP addresses and enforce multi-factor authentication for admin account access. Implement parameterized queries (prepared statements) with bound variables in the view_service.php file to prevent SQL injection. Consult the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-36947 and monitor Sourcecodester's GitHub repository (https://github.com/huliangjia/bug_report/blob/main/Sourcecodester/computer-and-mobile-repair-shop-management-system/SQL-5.md) for patch availability.