What is the CVSS score of CVE-2026-39109?

CVE-2026-39109 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-39109?

Apartment Visitors Management System V1.1 contains a critical SQL injection vulnerability in the login form that allows unauthenticated attackers to bypass authentication and access the entire…

How to fix or mitigate CVE-2026-39109?

Within 24 hours: Inventory all systems running Apartment Visitors Management System V1.1 and isolate internet-facing instances from public access using network segmentation or firewall rules. Within 7 days: Contact the vendor for patch availability status and timeline; if unavailable, implement Web Application Firewall (WAF) rules to block SQL injection patterns in the username parameter. Within 30 days: Evaluate replacement products with current security patches or decommission the system if the vendor confirms no patch will be released.

PHP CVE-2026-39109

EUVD-2026-23918 CRITICAL

SQL Injection (CWE-89)

2026-04-20 mitre

GHSA-mr7v-cwcf-gg84

PHP SQLi N A

9.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 20, 2026 - 20:32 vuln.today

CVSS changed

Apr 20, 2026 - 19:22 NVD

9.4 (CRITICAL)

EUVD ID Assigned

Apr 20, 2026 - 18:00 euvd

EUVD-2026-23918

Analysis Generated

Apr 20, 2026 - 18:00 vuln.today

CVE Published

Apr 20, 2026 - 00:00 nvd

CRITICAL 9.4

DescriptionCVE.org

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (index.php). This allows an unauthenticated attacker to manipulate backend SQL queries during authentication and retrieve sensitive database contents.

AnalysisAI

SQL injection in Apartment Visitors Management System V1.1's login form allows remote unauthenticated attackers to bypass authentication and extract database contents via the username parameter. The vulnerability scores 9.4 CVSS with network attack vector and low complexity. Public exploit code exists (SSVC confirms POC status), making this immediately exploitable. EPSS data unavailable, but SSVC framework rates it as automatable with partial technical impact, indicating high practical risk for internet-exposed installations.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application's authentication mechanism. The login page (index.php) fails to properly sanitize or parameterize the username input before incorporating it into SQL queries. Attackers can inject malicious SQL syntax into the username field to manipulate the authentication query logic, typically bypassing login checks via always-true conditions (e.g., ' OR '1'='1) or using UNION-based injection to extract data from arbitrary database tables. The CPE string is generic (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), indicating limited vendor cooperation with MITRE's enumeration process. The affected product is a PHP/MySQL-based apartment visitor tracking system distributed by PHPGurukul, a vendor known for educational/demonstration web applications often deployed in small business or academic environments without rigorous security review.

RemediationAI

No vendor-released patch identified at time of analysis - PHPGurukul references point to product pages, not security advisories. Primary mitigation: Immediately remove system from public internet access or decommission if alternative solutions exist. If continued operation is required, implement compensating controls with trade-offs: (1) Deploy web application firewall (WAF) with SQL injection signatures targeting the /index.php username parameter - reduces but does not eliminate risk as attackers may bypass signature-based detection; adds latency and management overhead. (2) Restrict access via IP allowlisting to known property management networks - effective only if user base has static IPs; breaks remote access workflows. (3) Place application behind VPN gateway requiring pre-authentication - most secure option but adds user friction and VPN infrastructure costs. (4) Monitor database query logs for SQL syntax in username fields (UNION, OR, --, /*) as detective control - generates alerts but does not prevent exploitation. Long-term: Migrate to commercially supported access control system with secure development lifecycle. Exploit code at https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/ can be used for verification testing in isolated environment. Organizations should audit for unauthorized database access since initial deployment date.