What is the CVSS score of CVE-2026-37592?

CVE-2026-37592 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-37592

EUVD-2026-22258 LOW

SQL Injection (CWE-89)

2026-04-14 mitre

GHSA-997p-hfm2-4w8j

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:03 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22258

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php.

AnalysisAI

SQL injection in Sourcecodester Storage Unit Rental Management System v1.0 allows high-privilege authenticated administrators to execute arbitrary SQL queries via the /storage/admin/maintenance/manage_pricing.php endpoint, resulting in partial confidentiality impact. The CVSS score of 2.7 reflects the requirement for high administrative privileges and absence of integrity or availability impact, placing this as a low-risk vulnerability despite the SQL injection classification. No public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in a PHP-based web application. The affected endpoint /storage/admin/maintenance/manage_pricing.php fails to properly sanitize or parameterize user input before constructing SQL queries, allowing attackers with administrative credentials to inject arbitrary SQL commands. The application uses PHP and interacts with a backend database, likely MySQL or similar. The CPE data indicates this is a third-party rental management system, though exact vendor identification is incomplete (n/a). SQL injection in this context allows reading sensitive data from the database, but the limited scope (partial confidentiality, no integrity or availability impact) suggests the injection point is either constrained to SELECT queries or lacks proper error handling for demonstrating data exfiltration.

RemediationAI

Implement parameterized queries (prepared statements) throughout the manage_pricing.php file and all other database interaction points to prevent SQL injection. Replace all string concatenation-based SQL construction with bound parameters using PHP's mysqli prepared statements or PDO prepared statements. Additionally, enforce principle of least privilege by restricting the database user account to SELECT-only permissions where write operations are not required for pricing queries, and implement input validation and output encoding as defense-in-depth layers. Review the GitHub advisory at https://github.com/shininadd/cve_report/blob/main/sourcecodester/storage-unit-rental-management-system/SQL-4.md and check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-37592 for patch availability. If the affected system is maintained, contact the vendor for a patched release; if development has ceased, consider migrating to an actively maintained rental management platform.