What is the CVSS score of CVE-2026-37590?

CVE-2026-37590 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-37590

EUVD-2026-22255 LOW

SQL Injection (CWE-89)

2026-04-14 mitre

GHSA-xxwj-xx57-672q

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:03 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22255

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php.

AnalysisAI

SQL injection in SourceCodester Storage Unit Rental Management System v1.0 allows high-privileged authenticated attackers to read sensitive database contents via crafted input in /storage/admin/rents/manage_rent.php. The vulnerability requires administrator-level access and produces only limited information disclosure with no impact on data integrity or availability. EPSS and SSVC assessments indicate minimal real-world exploitation risk due to authentication barrier and non-automatable attack requirements.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in a PHP-based web application. The affected file manage_rent.php fails to properly sanitize user-supplied input before incorporating it into SQL queries, allowing an authenticated administrator to inject arbitrary SQL commands. The vulnerability resides in a rental management system's administrative backend, suggesting the vulnerable code likely processes rental or unit data through insufficiently parameterized database operations. PHP applications using direct string concatenation in SQL queries without prepared statements or input validation are susceptible to this attack pattern.

RemediationAI

Apply a security update to SourceCodester Storage Unit Rental Management System once the vendor releases a patched version addressing SQL injection in manage_rent.php. Immediate mitigation involves implementing parameterized queries (prepared statements) in the affected file and conducting a code review of all administrative backend functions for similar injection flaws. Until patching is possible, restrict admin panel access to trusted networks and monitor administrative account activity for suspicious SQL-like input patterns. Consult the vendor advisory at https://github.com/shininadd/cve_report/blob/main/sourcecodester/storage-unit-rental-management-system/SQL-1.md and NIST VUL at https://nvd.nist.gov/vuln/detail/CVE-2026-37590 for vendor-specific guidance.