What is the CVSS score of CVE-2026-37593?

CVE-2026-37593 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-37593

EUVD-2026-22260 LOW

SQL Injection (CWE-89)

2026-04-14 mitre

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:03 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22260

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_att.php.

AnalysisAI

SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privileged authenticated attackers to execute arbitrary SQL queries via the /wfh_attendance/admin/view_att.php endpoint, potentially disclosing sensitive employee attendance data. The vulnerability requires administrative credentials and carries low real-world risk despite SQL injection's severity class, as evidenced by CVSS 2.7 and SSVC designation of no exploitation likelihood with partial technical impact. No public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability stems from improper input validation and sanitization in a PHP-based web application (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The affected endpoint /wfh_attendance/admin/view_att.php fails to parameterize SQL queries or adequately escape user-supplied input, enabling attackers with administrative roles to inject malicious SQL syntax. This is a classic SQL injection flaw common in legacy PHP applications that do not employ prepared statements or parameterized query frameworks. The CPE data indicates this is a third-party application rather than a widely deployed enterprise product, limiting its attack surface.

RemediationAI

The primary remediation is to upgrade SourceCodester Online Employees Work From Home Attendance System to a patched version if the vendor has released one; however, patch availability details are not confirmed from the provided advisory data. Immediate remediation steps include: (1) ensure the /wfh_attendance/admin/view_att.php file is inaccessible to untrusted network sources via web application firewall rules or network segmentation; (2) implement input validation and prepared statements (parameterized queries) in the affected PHP code to neutralize SQL injection attacks; (3) restrict administrative access to the application using strong authentication and role-based access controls to limit exposure to high-privilege users; (4) conduct a security audit of all SQL-handling code in the application. Reference the GitHub technical report at https://github.com/shininadd/cve_report/blob/main/sourcecodester/online-employees-work-home-attendance-system/SQL-1.md for proof-of-concept details and code patterns to remediate.