What is the CVSS score of CVE-2026-37596?

CVE-2026-37596 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-37596

EUVD-2026-22266 LOW

SQL Injection (CWE-89)

2026-04-14 mitre

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 16:59 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22266

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php.

AnalysisAI

SQL injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to extract sensitive database information via the /wfh_attendance/admin/manage_department.php endpoint. The CVSS 2.7 score reflects low real-world risk due to the requirement for high-privilege administrative credentials and confidentiality-only impact; no public exploit code has been identified, and the vulnerability is not confirmed as actively exploited.

Technical ContextAI

The vulnerability exists in a PHP-based web application (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) within the department management interface. The affected file manage_department.php fails to properly sanitize or parameterize user input before constructing SQL queries, allowing attackers who already possess administrative credentials to inject arbitrary SQL commands. This is a classic SQL injection flaw in a legacy PHP application without prepared statements or input validation.

RemediationAI

The primary remediation is to update SourceCodester Online Employees Work From Home Attendance System to the latest available version beyond 1.0; however, no specific patched version number is independently confirmed in the provided references. As an immediate workaround, restrict administrative access to the manage_department.php endpoint to trusted internal networks only, and audit administrative account activity for suspicious SQL-like input patterns. Consult the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-37596 and the detailed technical report at https://github.com/shininadd/cve_report/blob/main/sourcecodester/online-employees-work-home-attendance-system/SQL-3.md for vendor-recommended patches or configuration hardening steps.