Which versions of PHP are affected by CVE-2026-3764?

A high-severity vulnerability in SourceCodester Client Database Management System 1.0 allows unauthorized modification of superadmin user accounts with no patch currently available.

Is there a public PoC exploit available for CVE-2026-3764?

Yes, a public proof-of-concept exploit is available for CVE-2026-3764. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3764?

Within 24 hours: Immediately disable or restrict access to /superadmin_user_update.php via firewall rules and verify superadmin account integrity for unauthorized modifications. Within 7 days: Implement WAF rules to block requests to the vulnerable endpoint, conduct forensic audit of superadmin account change logs, and initiate vendor contact for emergency patch timeline. Within 30 days: Develop migration plan to alternative database management solution or deploy compensating network controls; maintain daily monitoring of superadmin activity until patch availability.

PHP CVE-2026-3764

Q: What is the CVSS score of CVE-2026-3764?

CVE-2026-3764 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-03-08 cna@vuldb.com

PHP Information Disclosure Client Database Management System Lerouxyxchire

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 16:30 vuln.today

Public exploit code

CVE Published

Mar 08, 2026 - 20:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was determined in SourceCodester Client Database Management System 1.0. The impacted element is an unknown function of the file /superadmin_user_update.php. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Improper authorization in SourceCodester Client Database Management System 1.0 allows unauthenticated remote attackers to manipulate the /superadmin_user_update.php file, potentially gaining unauthorized access to sensitive functionality. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.

Technical ContextAI

Affects Client Database Management System. A vulnerability was determined in SourceCodester Client Database Management System 1.0. The impacted element is an unknown function of the file /superadmin_user_update.php. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.