What is the CVSS score of CVE-2026-37594?

CVE-2026-37594 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-37594

EUVD-2026-22262 LOW

SQL Injection (CWE-89)

2026-04-14 mitre

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:03 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22262

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php.

AnalysisAI

SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege remote attackers to read sensitive database contents via crafted input to the /wfh_attendance/admin/view_employee.php endpoint. CVSS 2.7 reflects high authentication barriers (PR:H requires admin access), no automatable exploitation per SSVC, and confidentiality impact only. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in a PHP-based web application used for remote work attendance tracking. CWE-89 (SQL Injection) indicates insufficient input validation in database query construction within the view_employee.php administrative interface. Unauthenticated SQL injection attacks are blocked by the CVSS PR:H (high privilege requirement) constraint, meaning only authenticated administrators with high-level access can craft malicious SQL payloads. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), indicating straightforward exploitation mechanics once administrative credentials are obtained. The limited scope (S:U) and confidentiality impact (C:L) suggest query results are restricted to the attacking account's data context rather than permitting lateral privilege escalation or system-wide compromise.

RemediationAI

Apply vendor patches or code updates that implement parameterized queries (prepared statements) in the view_employee.php administrative interface to eliminate SQL injection vectors. Upgrade to a patched version released after CVE-2026-37594 disclosure if available from SourceCodester. As an interim mitigation, restrict administrative access to trusted users only, enforce strong authentication (multi-factor authentication preferred) on all admin accounts, and implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the /wfh_attendance/admin/ endpoint. Monitor admin account activity and database query logs for suspicious SQL syntax. Consult SourceCodester security advisories and the GitHub technical report (https://github.com/shininadd/cve_report/blob/main/sourcecodester/online-employees-work-home-attendance-system/SQL-2.md) for patch availability.