What is the CVSS score of CVE-2026-37602?

CVE-2026-37602 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-37602

EUVD-2026-22272 LOW

SQL Injection (CWE-89)

2026-04-14 mitre

GHSA-5xvq-hmf7-8pf3

PHP SQLi

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:03 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22272

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.

AnalysisAI

SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 at /scheduler/admin/user/manage_user.php allows high-privilege authenticated attackers to read sensitive data via crafted SQL queries. CVSS score of 2.7 reflects the requirement for high administrative privileges (PR:H), limiting real-world impact. SSVC framework confirms no known active exploitation, non-automatable attack, and partial technical impact (confidentiality only). This is a low-severity vulnerability constrained by authentication requirements despite the presence of a SQL injection flaw.

Technical ContextAI

The vulnerability exists in the PHP-based Patient Appointment Scheduler System, a web application for managing patient appointments and administrative functions. SQL injection (CWE-89) occurs in the manage_user.php admin endpoint, indicating insufficient input sanitization or parameterized query usage in user management database operations. The affected endpoint processes user-supplied data without proper SQL statement construction, allowing malicious SQL metacharacters to alter query logic. PHP applications commonly handle database operations through mysqli or PDO libraries; the presence of unsanitized input in this context suggests reliance on manual string concatenation rather than prepared statements with bound parameters.

RemediationAI

Implement prepared statements (parameterized queries) in manage_user.php to prevent SQL injection, using PHP PDO or mysqli with bound parameters for all user input passed to SQL queries. Validate and sanitize all administrative input using allowlist-based input validation appropriate to each field type. Apply principle of least privilege to database credentials used by the application. If an immediate patch from SourceCodester is unavailable, use stored procedures with parameterized inputs as an interim control. Review the GitHub reference (https://github.com/shininadd/cve_report/blob/main/sourcecodester/patient-appointment-scheduler-system/SQL-3.md) for additional exploitation context and technical remediation details. Consider upgrading to a patched version if released by the vendor, or migrating to a maintained alternative if this application receives infrequent updates.