What is the CVSS score of CVE-2026-37601?

CVE-2026-37601 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-37601

EUVD-2026-22271 LOW

SQL Injection (CWE-89)

2026-04-14 mitre

GHSA-h62w-pgwx-cpqf

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:03 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22271

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.

AnalysisAI

SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 allows authenticated high-privilege administrators to read sensitive data through the /scheduler/admin/appointments/manage_appointment.php endpoint. The vulnerability requires administrative credentials and does not enable data modification or denial of service, limiting real-world impact despite network-accessible exposure. CVSS score of 2.7 reflects the high authentication barrier and confidentiality-only impact; CISA SSVC framework rates exploitation as 'none' with no automatable attack path.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in a PHP-based web application. The manage_appointment.php administrative interface fails to properly sanitize or parameterize user input before embedding it into SQL queries. SQL injection occurs when untrusted input is concatenated directly into SQL statements, allowing attackers to manipulate query logic, extract data, or modify database contents. In this case, the flaw is constrained to read-only access and requires the attacker to already possess administrative credentials, significantly reducing the attack surface. The PHP application architecture (typical of SourceCodester educational/demo projects) likely uses mysqli or PDO without prepared statements.

RemediationAI

Remediate by immediately upgrading to a patched version if released by SourceCodester, or apply code-level fixes by implementing prepared statements (parameterized queries) in the manage_appointment.php file. Use mysqli prepared statements or PDO with bound parameters to separate SQL syntax from data. Example: replace mysqli_query($conn, "SELECT * FROM appointments WHERE id = " . $_GET['id']) with mysqli_prepare() and bind_param(). Review all administrative PHP files for similar SQL injection vulnerabilities. Consult the GitHub report at https://github.com/shininadd/cve_report/blob/main/sourcecodester/patient-appointment-scheduler-system/SQL-2.md for technical details, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-37601 for additional context. No public exploit code is documented, so patching can occur on a standard maintenance cycle.