What is the CVSS score of CVE-2026-36948?

CVE-2026-36948 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-36948?

Sourcecodester Online Thesis Archiving System v1.0 contains a critical SQL injection vulnerability in its archive viewing functionality that allows unauthenticated attackers to extract sensitive…

How to fix or mitigate CVE-2026-36948?

24 hours: Identify all deployed instances of Sourcecodester Online Thesis Archiving System v1.0 across the organization and document network locations and data sensitivity. 7 days: Implement web application firewall (WAF) rules to block SQL injection patterns in /otas/view_archive.php endpoint; restrict unauthenticated access to the archive module through network segmentation or authentication enforcement. 30 days: Prioritize migration to a patched alternative thesis archiving system; if continued operation is mandatory, conduct full database audit for unauthorized access and credential exposure dating back to deployment.

PHP CVE-2026-36948

EUVD-2026-22004 HIGH

SQL Injection (CWE-89)

2026-04-13 mitre

PHP SQLi

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 14:22 vuln.today

CVSS changed

Apr 14, 2026 - 14:22 NVD

7.3 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 16:45 euvd

EUVD-2026-22004

Analysis Generated

Apr 13, 2026 - 16:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

HIGH 7.3

DescriptionCVE.org

Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php.

AnalysisAI

SQL injection in Sourcecodester Online Thesis Archiving System v1.0's /otas/view_archive.php endpoint allows remote unauthenticated attackers to manipulate database queries, potentially extracting sensitive thesis data, authentication credentials, or modifying database contents. No public exploit identified at time of analysis, with minimal observed exploitation probability (EPSS 0.01%, 2nd percentile). The vulnerability affects a PHP-based academic archiving platform with limited deployment footprint.

Technical ContextAI

This is a classic CWE-89 SQL injection vulnerability in a PHP web application. The affected endpoint /otas/view_archive.php likely accepts user-supplied parameters (typically thesis ID or search terms) without proper input sanitization or parameterized query usage. Online Thesis Archiving System v1.0 is a small-scale academic document management application, suggesting standard LAMP/WAMP stack deployment with MySQL/MariaDB backend. SQL injection occurs when untrusted input is directly concatenated into SQL query strings, allowing attackers to inject malicious SQL syntax that alters query logic. The network-accessible attack vector (AV:N) with low complexity (AC:L) indicates the vulnerable parameter is exposed via HTTP GET/POST requests without requiring special network positioning or timing conditions.

RemediationAI

No vendor-released patch identified at time of analysis. The primary reference is a third-party bug report on GitHub at https://github.com/huliangjia/bug_report/blob/main/Sourcecodester/online-thesis-archiving-system/SQL-1.md which documents the vulnerability but does not provide an official fix. Administrators should immediately implement input validation and parameterized queries (prepared statements) for the /otas/view_archive.php endpoint. As an interim mitigation, restrict access to the vulnerable endpoint via web application firewall rules or .htaccess authentication until code-level remediation can be applied. Review all user input handling across the application for similar SQL injection patterns given the systemic lack of input sanitization. Consider migrating to actively maintained thesis archiving platforms if Sourcecodester does not release security updates. Consult the official NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-36948 for updated vendor guidance.