What is the CVSS score of CVE-2026-37597?

CVE-2026-37597 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-37597

EUVD-2026-22268 LOW

SQL Injection (CWE-89)

2026-04-14 mitre

GHSA-33rr-qfgw-97qc

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:03 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22268

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.

AnalysisAI

SQL injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to execute arbitrary SQL queries via the /wfh_attendance/admin/attendance_list.php endpoint, enabling unauthorized data disclosure with low confidentiality impact. The vulnerability requires administrator-level access and carries minimal real-world risk due to high privilege requirements and low exploitability (SSVC exploitation status: none), though it represents a defense-in-depth failure in an administrative function.

Technical ContextAI

The vulnerability is a SQL injection flaw (CWE-89) in a PHP-based web application. The affected endpoint attendance_list.php fails to properly sanitize or parameterize user-supplied input before constructing SQL queries. The attack surface is limited to the admin panel (/wfh_attendance/admin/), which inherently restricts access to administrative users. SQL injection in PHP applications typically occurs when concatenating user input directly into query strings without prepared statements or input validation, allowing attackers to break out of the intended query logic and inject arbitrary SQL syntax.

RemediationAI

Apply input validation and parameterized queries to all database interactions in attendance_list.php. If a vendor patch is available, upgrade to the patched version immediately; however, no specific fixed version is currently confirmed. In the interim, implement prepared statements using PHP's PDO or MySQLi with bound parameters instead of string concatenation for SQL query construction. Restrict access to /wfh_attendance/admin/ via network segmentation or WAF rules to limit exposure to authorized administrative IP addresses only. Conduct a code audit of all other admin pages in the application for similar SQL injection patterns, as this suggests a broader input validation weakness. References for proof-of-concept and technical details are available at https://github.com/shininadd/cve_report/blob/main/sourcecodester/online-employees-work-home-attendance-system/SQL-5.md and https://nvd.nist.gov/vuln/detail/CVE-2026-37597.