What is the CVSS score of CVE-2026-36950?

CVE-2026-36950 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36950

EUVD-2026-22006 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 16:22 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 16:45 euvd

EUVD-2026-22006

Analysis Generated

Apr 13, 2026 - 16:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php.

AnalysisAI

SQL injection in Sourcecodester Online Thesis Archiving System v1.0 allows high-privilege authenticated attackers to extract sensitive information via the /otas/projects_per_department.php endpoint. The vulnerability requires admin-level credentials (PR:H per CVSS) and has minimal confidentiality impact with an EPSS score of 0.01%, indicating very low real-world exploitation probability despite public disclosure on GitHub.

Technical ContextAI

The vulnerability exists in a PHP web application endpoint that processes department-based project queries. CWE-89 (SQL Injection) indicates the application fails to properly sanitize or parameterize user input before constructing SQL queries, allowing attackers to manipulate query logic. The affected component (projects_per_department.php) likely concatenates user-supplied parameters directly into SQL statements without prepared statements or input validation. This is a classic PHP web application flaw common in older or hastily-developed systems.

RemediationAI

The primary remediation is to upgrade to a patched version if available from the vendor, or to implement input validation and parameterized queries (prepared statements) in the vulnerable /otas/projects_per_department.php file immediately. Specifically, all user-supplied parameters should be bound using prepared statements or properly escaped SQL escaping functions to prevent query injection. Until patching is possible, restrict access to the /otas/ administrative interface via network controls (IP whitelisting, WAF rules) to limit exposure to trusted administrators only. Refer to the GitHub bug report (https://github.com/huliangjia/bug_report/blob/main/Sourcecodester/online-thesis-archiving-system/SQL-2.md) for technical reproduction details and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-36950) for official vendor guidance.