What is the CVSS score of CVE-2026-36952?

CVE-2026-36952 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36952

EUVD-2026-22008 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 16:22 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 16:45 euvd

EUVD-2026-22008

Analysis Generated

Apr 13, 2026 - 16:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php.

AnalysisAI

SQL injection in Sourcecodester Online Thesis Archiving System v1.0 at /otas/admin/curriculum/manage_curriculum.php allows authenticated high-privileged administrators to extract sensitive database information through unsanitized query parameters. With a CVSS score of 2.7 and EPSS of 0.01% (2nd percentile), this vulnerability presents minimal real-world risk despite valid SQL injection mechanics, as exploitation requires admin-level credentials and yields only confidentiality impact. No public exploit code or active exploitation has been confirmed.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in a PHP-based web application. The affected file manage_curriculum.php fails to properly sanitize user-supplied input before incorporating it into SQL queries, likely through inadequate use of prepared statements or input validation. SQL injection occurs when untrusted data is concatenated directly into SQL command strings, allowing attackers to modify query logic and access unauthorized database records. In this case, the vulnerable endpoint is accessible only to authenticated administrators, limiting the attack surface to users with elevated privileges within the Online Thesis Archiving System.

RemediationAI

Developers should immediately implement parameterized queries (prepared statements) in PHP using mysqli::prepare() or PDO::prepare() to separate SQL structure from user-supplied data. All instances of dynamic query construction in manage_curriculum.php must be refactored to use bound parameters. Additionally, enforce strict input validation and employ a whitelist approach for curriculum identifiers and related parameters. Input should be validated for expected type and format before database operations. Organizations deploying this system should upgrade to a patched version once released by Sourcecodester, or apply a Web Application Firewall (WAF) rule to block SQL injection patterns in the /otas/admin/curriculum/ endpoint as a temporary compensating control. No vendor-released patch version has been independently confirmed at the time of this analysis.