What is the CVSS score of CVE-2026-37345?

CVE-2026-37345 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Vehicle Parking Area Management System are affected by CVE-2026-37345?

SourceCodester Vehicle Parking Area Management System v1.0 contains a critical SQL injection vulnerability (CVE-2026-37345, CVSS 9.8) in the /parking/manage_park.php endpoint that allows…

How to fix or mitigate CVE-2026-37345?

Within 24 hours, complete an inventory of all deployed instances of SourceCodester Vehicle Parking Area Management System v1.0 and determine which handle sensitive data (user records, payment information, or access logs). Within 7 days, restrict network access to the /parking/manage_park.php endpoint through segmentation or firewall rules, deploy WAF rules to block SQL injection patterns, and configure database account privileges to read-only where operationally feasible. Within 30 days, contact SourceCodester for patched version availability; if no patch is released, evaluate replacement parking management systems or implement air-gapping with restricted external access until a vendor fix or alternative is deployed.

Vehicle Parking Area Management System CVE-2026-37345

EUVD-2026-23262 CRITICAL

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-rjr7-qx4v-48vv

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote unauthenticated SQL injection with no user interaction (AV:N/AC:L/PR:N/UI:N); SQLi permits full read, modification, and deletion of the database, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:35 vuln.today

CVSS changed

Apr 16, 2026 - 16:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23262

CVE Published

Apr 16, 2026 - 15:17 nvd

CRITICAL 9.8

DescriptionCVE.org

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_park.php.

AnalysisAI

SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 lets remote unauthenticated attackers manipulate backend database queries through the /parking/manage_park.php endpoint. Public proof-of-concept exploit code exists (per the mt-0505 CVE report and VulDB entry), and the flaw is automatable with total technical impact, though EPSS remains very low at 0.03% (9th percentile). No public evidence of active exploitation has been identified.

Technical ContextAI

The affected component is a PHP-based web application (tags: PHP, SQLi) built by SourceCodester, a source of small open-source PHP/MySQL projects commonly used for learning and small-business deployments. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaching /parking/manage_park.php is concatenated directly into a SQL statement without parameterization or sanitization. Because SourceCodester applications typically use MySQL/MariaDB with mysqli or raw query strings, an injectable parameter allows the attacker to alter query logic, enumerate schema, and extract or modify stored records.

RemediationAI

No vendor-released patch identified at time of analysis, as SourceCodester single-developer projects rarely issue tagged security releases. The primary compensating control is to rewrite all database access in /parking/manage_park.php (and by extension the whole application) to use parameterized queries/prepared statements with mysqli or PDO, and to validate/whitelist input types; if source modification is not feasible, deploy a web application firewall with SQL-injection signatures in front of the application, accepting that WAF rules can be bypassed and may cause false positives on legitimate input. Additionally, restrict network access to the /parking/ application to trusted internal users or VPN (trade-off: breaks any intended public access), remove the application from internet-facing exposure, and apply least-privilege to the database account so a successful injection cannot escalate beyond the parking schema. Review the technical details at https://github.com/mt-0505/cve-report and https://vuldb.com/vuln/357942 before mitigating.