Is PHP affected by CVE-2026-36948?

Sourcecodester Online Thesis Archiving System v1.0 contains a critical SQL injection vulnerability in its archive viewing functionality that allows unauthenticated attackers to extract sensitive thesis data and authentication credentials from the database.

CVE-2026-36948

EUVD-2026-22004 HIGH

2026-04-13 mitre

PHP SQLi N A

7.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 14:22 vuln.today

CVSS Changed

Apr 14, 2026 - 14:22 NVD

7.3 (HIGH)

DescriptionNVD

Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php.

AnalysisAI

SQL injection in Sourcecodester Online Thesis Archiving System v1.0's /otas/view_archive.php endpoint allows remote unauthenticated attackers to manipulate database queries, potentially extracting sensitive thesis data, authentication credentials, or modifying database contents. No public exploit identified at time of analysis, with minimal observed exploitation probability (EPSS 0.01%, 2nd percentile). …

RemediationAI

24 hours: Identify all deployed instances of Sourcecodester Online Thesis Archiving System v1.0 across the organization and document network locations and data sensitivity. 7 days: Implement web application firewall (WAF) rules to block SQL injection patterns in /otas/view_archive.php endpoint; restrict unauthenticated access to the archive module through network segmentation or authentication enforcement. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-36948 vulnerability details – vuln.today

Back