Which versions of PHP are affected by CVE-2026-3747?

A high-severity vulnerability in the University Management System's result submission functionality (CVE-2026-3747) poses a direct threat to data integrity and system availability.

Is there a public PoC exploit available for CVE-2026-3747?

Yes, a public proof-of-concept exploit is available for CVE-2026-3747. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3747?

Within 24 hours: Isolate the /add_result.php endpoint from untrusted networks and disable public access if operationally feasible; document current user access patterns. Within 7 days: Implement WAF rules to restrict /add_result.php requests, enable enhanced logging/monitoring, and assess the system's role in your critical infrastructure. Within 30 days: Contact vendor for patch status and timeline; evaluate migration to alternative systems if patch availability extends beyond 60 days.

PHP CVE-2026-3747

Q: What is the CVSS score of CVE-2026-3747?

CVE-2026-3747 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-08 cna@vuldb.com

PHP SQLi University Management System Angeljudesuarez

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 15:16 vuln.today

Public exploit code

CVE Published

Mar 08, 2026 - 16:16 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /add_result.php. Such manipulation of the argument subject leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode University Management System 1.0 via the subject parameter in /add_result.php enables remote attackers to execute arbitrary database queries without authentication. Public exploit code exists for this vulnerability, and no patch is currently available. Affected installations face potential data exfiltration, modification, or deletion through unauthenticated network-based attacks.

Technical ContextAI

Affects University Management System. A vulnerability was identified in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /add_result.php. Such manipulation of the argument subject leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.