What is the CVSS score of CVE-2026-37344?

CVE-2026-37344 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-37344?

SourceCodester Vehicle Parking Area Management System v1.0 contains a SQL injection vulnerability in the admin location management interface that could allow compromised administrators to extract or…

How to fix or mitigate CVE-2026-37344?

Within 24 hours: inventory all deployments of Vehicle Parking Area Management System v1.0 and document admin account holders. Within 7 days: implement network segmentation to restrict /parking/manage_location.php access to trusted administrative networks only, enforce multi-factor authentication for all admin accounts, and review admin access logs for suspicious queries. Within 30 days: evaluate replacement with a patched version if vendor releases an update, or plan migration to alternative parking management software with active security support.

PHP CVE-2026-37344

EUVD-2026-23260 HIGH

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-7crm-7p4w-3558

PHP SQLi

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 18, 2026 - 03:23 vuln.today

CVSS changed

Apr 18, 2026 - 03:22 NVD

7.2 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23260

Analysis Generated

Apr 16, 2026 - 15:22 vuln.today

CVE Published

Apr 16, 2026 - 15:17 nvd

HIGH 7.2

DescriptionCVE.org

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_location.php.

AnalysisAI

SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows authenticated administrators to execute arbitrary SQL commands via the /parking/manage_location.php endpoint. CVSS 7.2 indicates high-privilege requirement (PR:H) limiting exploitation to compromised admin accounts or insider threats. EPSS score of 0.01% (2nd percentile) suggests minimal observed exploitation activity. No CISA KEV listing indicates no confirmed active exploitation in enterprise environments.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based parking management application. SQL injection occurs when user-supplied input is concatenated directly into SQL queries without proper parameterization or escaping, allowing attackers to manipulate query logic. The vulnerable endpoint /parking/manage_location.php likely handles location management functions (creating, updating, or deleting parking location records) and fails to sanitize input parameters before passing them to database queries. SourceCodester applications are often educational/demonstration codebases with limited security hardening, frequently exhibiting input validation flaws. The PHP technology stack combined with direct SQL query construction creates the attack surface.

RemediationAI

No vendor-released patch or updated version has been identified for Vehicle Parking Area Management System v1.0. The GitHub reference (https://github.com/mt-0505/cve-report/blob/main/sourcecodester/vehicle-parking-area-management-system/SQL-3.md) contains vulnerability details but does not link to an official fix. Organizations running this system should implement immediate compensating controls: (1) Restrict admin panel access to specific IP addresses via web server configuration (htaccess IP whitelisting or firewall rules) to limit attack surface to trusted networks only - trade-off is reduced administrative flexibility for remote management; (2) Deploy a web application firewall with SQL injection signatures to detect and block exploitation attempts at /parking/manage_location.php - may cause false positives requiring rule tuning; (3) Enable detailed SQL query logging and monitor for suspicious patterns (UNION, OR 1=1, comment sequences) in location management operations; (4) If source code access is available, manually patch by converting SQL queries in manage_location.php to use prepared statements with parameterized queries (mysqli_prepare or PDO prepared statements in PHP). Long-term recommendation is to migrate to actively maintained parking management software with security update commitments.