Which versions of PHP are affected by CVE-2026-3708?

A high-severity vulnerability in the Simple Flight Ticket Booking System's login function poses a significant risk to user account security and system integrity.

Is there a public PoC exploit available for CVE-2026-3708?

Yes, a public proof-of-concept exploit is available for CVE-2026-3708. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3708?

Within 24 hours: Disable public internet access to the affected login.php file or take the application offline pending remediation; notify all users of potential exposure. Within 7 days: Deploy Web Application Firewall (WAF) rules to block known exploit patterns; implement IP-based access restrictions; establish vendor communication to obtain patch timeline. Within 30 days: Apply patch immediately upon vendor release; conduct forensic analysis for unauthorized access; reset credentials for all affected users.

PHP CVE-2026-3708

Q: What is the CVSS score of CVE-2026-3708?

CVE-2026-3708 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-08 cna@vuldb.com

PHP SQLi Simple Flight Ticket Booking System Carmelo

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 16:18 vuln.today

Public exploit code

CVE Published

Mar 08, 2026 - 05:16 nvd

HIGH 7.3

DescriptionCVE.org

A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. The impacted element is an unknown function of the file /login.php. Performing a manipulation of the argument Username results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in Simple Flight Ticket Booking System 1.0's login functionality allows unauthenticated attackers to manipulate the Username parameter and execute arbitrary database queries remotely. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. PHP installations running the affected application should be isolated until a security patch becomes available.

Technical ContextAI

Affects Simple Flight Ticket Booking System. A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. The impacted element is an unknown function of the file /login.php. Performing a manipulation of the argument Username results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.