What is the CVSS score of CVE-2026-39110?

CVE-2026-39110 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39110?

Apartment Visitors Management System v1.1 contains an unauthenticated SQL injection vulnerability in the password reset function that enables attackers to extract sensitive database contents without…

How to fix or mitigate CVE-2026-39110?

Within 24 hours: Disable or restrict network access to the password reset functionality on all Apartment Visitors Management System v1.1 instances; document affected systems and data scope. Within 7 days: Deploy input validation and parameterized query mitigations (see compensating_controls); conduct database access logs review for exploitation indicators. Within 30 days: Upgrade to a patched version when available from vendor or migrate to alternative solution; perform full security assessment of password reset and authentication mechanisms.

PHP CVE-2026-39110

EUVD-2026-23919 HIGH

SQL Injection (CWE-89)

2026-04-20 mitre

GHSA-m39g-8x47-rrc5

PHP SQLi N A

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 20, 2026 - 20:32 vuln.today

CVSS changed

Apr 20, 2026 - 19:22 NVD

8.2 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 18:00 euvd

EUVD-2026-23919

Analysis Generated

Apr 20, 2026 - 18:00 vuln.today

CVE Published

Apr 20, 2026 - 00:00 nvd

HIGH 8.2

DescriptionCVE.org

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of the forgot password page (forgot-password.php). This allows an unauthenticated attacker to manipulate backend SQL queries during authentication and retrieve sensitive database contents.

AnalysisAI

SQL injection in Apartment Visitors Management System v1.1 allows unauthenticated remote attackers to extract sensitive database contents via the contactno parameter on the password reset page. The vulnerability bypasses authentication controls through crafted input during password recovery operations. EPSS and KEV data not available, but SSVC framework indicates proof-of-concept exists and the vulnerability is automatable with partial technical impact. The CVSS score of 8.2 reflects high confidentiality impact with network-accessible attack surface requiring no user interaction.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based application where user-supplied input from the contactno parameter in forgot-password.php is insufficiently validated or sanitized before being incorporated into SQL queries. The vulnerable component appears to be a password recovery mechanism that queries the database using a phone number identifier. Insufficient input validation allows attackers to inject SQL metacharacters and additional SQL commands that alter the structure and logic of backend database queries. The application likely concatenates user input directly into SQL strings rather than using parameterized queries or prepared statements. CPE data indicates limited specificity (a:n/a:n/a), suggesting the vendor namespace is not formally registered in the NVD product dictionary. The application is distributed through phpgurukul.com as a learning/demonstration project.

RemediationAI

Primary remediation requires code modification to implement parameterized queries or prepared statements with bound parameters for all database interactions in forgot-password.php, specifically for the contactno parameter handling. Since this appears to be demonstration software without formal vendor support or published security advisories, organizations must apply fixes directly in source code. Review the GitHub repository at https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/ for potential community-developed patches or exploit details that inform remediation. If source modification is not immediately feasible, implement compensating controls: deploy web application firewall rules to block SQL injection patterns in the contactno parameter (though this introduces maintenance overhead and potential bypass risk); restrict access to forgot-password.php to trusted network ranges using web server access controls (reduces attack surface but impairs legitimate password recovery functionality); implement input validation that enforces strict phone number format requirements using allowlist patterns (reduces but does not eliminate SQL injection risk). For production environments, strongly consider replacing this application with actively maintained commercial or enterprise-grade visitor management software with established security track records.