Which versions of PHP are affected by CVE-2026-3746?

A high-severity authentication vulnerability in SourceCodester Simple Responsive Tourism Website 1.0 allows attackers to potentially bypass login controls and gain unauthorized access to sensitive…

Is there a public PoC exploit available for CVE-2026-3746?

Yes, a public proof-of-concept exploit is available for CVE-2026-3746. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3746?

Within 24 hours: Identify all systems running SourceCodester Simple Responsive Tourism Website 1.0 and document affected assets; implement network-level access controls to restrict traffic to the /tourism/classes/Login.php endpoint. Within 7 days: Deploy WAF rules to block suspicious login attempts; enable detailed logging on authentication endpoints; consider taking the application offline if it's not business-critical. Within 30 days: Migrate to an alternative tourism website solution or request an emergency patch from SourceCodester; conduct security audit of compromised systems; reset all user credentials.

PHP CVE-2026-3746

Q: What is the CVSS score of CVE-2026-3746?

CVE-2026-3746 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-08 cna@vuldb.com

PHP SQLi Simple Responsive Tourism Website Oretnom23

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 16:33 vuln.today

Public exploit code

CVE Published

Mar 08, 2026 - 16:16 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Simple Responsive Tourism Website 1.0 via the Username parameter in the Login.php component enables unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify application state. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected systems exposed to active exploitation.

Technical ContextAI

Affects the of the component of Simple Responsive Tourism Website. A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.