What is the CVSS score of CVE-2026-37347?

CVE-2026-37347 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Payroll Management System are affected by CVE-2026-37347?

SourceCodester Payroll Management System v1.0 contains a critical, unauthenticated SQL injection vulnerability exposing employee records and payroll data to remote attackers.

How to fix or mitigate CVE-2026-37347?

Within 24 hours: Isolate the SourceCodester Payroll v1.0 system from production networks if exploitation indicators are detected in access logs for the /payroll/view_employee.php endpoint; audit data access logs for suspicious activity. Within 7 days: Implement network-level access controls (firewall rules, VPN-only access) restricting the /payroll/view_employee.php endpoint to authorized internal IP ranges; deploy Web Application Firewall (WAF) rules to block SQL injection payloads on all payroll endpoints; rotate database credentials for accounts running the payroll application. Within 30 days: Migrate to a supported payroll solution with active security maintenance (current versions of ADP, BambooHR, Workday, or equivalent); conduct forensic review of data access logs for the period since system deployment; notify affected employees of potential exposure if unauthorized access occurred.

Payroll Management System CVE-2026-37347

EUVD-2026-23266 CRITICAL

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-fpjj-7r25-62gj

PHP SQLi

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Network-reachable SQL injection with no auth or interaction per the report (PR:N/UI:N/AC:L); read and write of DB data give C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:35 vuln.today

CVSS changed

Apr 16, 2026 - 16:22 NVD

9.1 (CRITICAL)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23266

CVE Published

Apr 16, 2026 - 15:17 nvd

CRITICAL 9.1

DescriptionCVE.org

SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php.

AnalysisAI

SQL injection in SourceCodester Payroll Management and Information System v1.0 lets remote unauthenticated attackers manipulate backend database queries through the /payroll/view_employee.php endpoint. The flaw exposes confidential employee and payroll data and permits tampering with stored records. Publicly available exploit code exists (community vulnerability report), though EPSS remains very low (0.03%, 10th percentile) and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a PHP web application (SourceCodester Payroll Management and Information System) that builds SQL statements against its backend database, almost certainly MySQL/MariaDB given the SourceCodester stack. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaching /payroll/view_employee.php (typically an employee record identifier passed via request parameter) is concatenated into a SQL query without parameterization or adequate sanitization. Because the injection sits in a data-retrieval page, an attacker can use UNION-based or boolean/time-based techniques to read and modify arbitrary tables. EUVD lists affected versions as 'n/a n/a', so precise CPE strings are not published; the vendor reference identifies only the v1.0 release.

RemediationAI

No vendor-released patch identified at time of analysis; SourceCodester applications are commonly distributed as source with infrequent maintenance, so a fixed release may not exist. The definitive fix is to rewrite the query in /payroll/view_employee.php to use parameterized queries/prepared statements (PDO or mysqli with bound parameters) and to cast/validate the employee identifier as an integer. Until a code fix is applied, apply compensating controls: place the application behind a WAF with SQL-injection signatures targeting the view_employee.php parameter (trade-off: signature bypasses are possible), restrict network access to the /payroll/ path to trusted internal users or VPN only (trade-off: breaks legitimate remote access), and enforce least-privilege database credentials so the web account cannot read or write beyond required tables (trade-off: limits data exposure but does not stop the injection itself). Review the referenced report (https://github.com/mt-0505/cve-report/blob/main/sourcecodester/payroll-management-and-information-system/SQL-2.md) and the VulDB entry (https://vuldb.com/vuln/357944) to identify the exact injectable parameter for precise blocking rules.