What is the CVSS score of CVE-2026-39111?

CVE-2026-39111 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39111?

Apartment Visitors Management System v1.1 contains an unauthenticated SQL injection vulnerability in the password reset function that allows attackers to extract sensitive user data without…

How to fix or mitigate CVE-2026-39111?

Within 24 hours: Identify all systems running Apartment Visitors Management System v1.1 and isolate internet-facing instances or restrict network access to trusted sources only. Within 7 days: Contact the vendor for security guidance and inquire about patches or updated versions; consider migrating to an alternative visitor management solution if no patch roadmap exists. Within 30 days: Deploy a complete replacement system or implement a Web Application Firewall (WAF) with SQL injection rules as an interim control; conduct forensic review of database logs for evidence of exploitation.

PHP CVE-2026-39111

EUVD-2026-23920 HIGH

SQL Injection (CWE-89)

2026-04-20 mitre

GHSA-2mm2-ghgp-p33q

PHP SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 18:52 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 18:28 vuln.today

CVSS changed

Apr 20, 2026 - 18:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 18:00 euvd

EUVD-2026-23920

Analysis Generated

Apr 20, 2026 - 18:00 vuln.today

CVE Published

Apr 20, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password page (forgot-password.php). This allows an unauthenticated attacker to manipulate backend SQL queries and retrieve sensitive user data.

AnalysisAI

SQL Injection in Apartment Visitors Management System v1.1 allows unauthenticated remote attackers to extract sensitive user data via the forgot-password.php email parameter. The vulnerability requires no authentication (PR:N), no user interaction (UI:N), and has low attack complexity (AC:L), enabling trivial exploitation against any internet-facing installation. EPSS data unavailable; not listed in CISA KEV. GitHub repository references suggest proof-of-concept code may exist, increasing immediate exploitation risk for the small but vulnerable user base of this PHP-based application.

Technical ContextAI

This vulnerability affects a PHP/MySQL-based visitor management application distributed by PHPGurukul. The flaw is a classic SQL injection (CWE-89) in the password recovery workflow, where user-supplied input from the 'email' parameter in forgot-password.php is insufficiently sanitized before being incorporated into SQL queries. The affected product appears to be a downloadable open-source application (download ID 21524 from phpgurukul.com), typical of educational/small-business systems that may lack secure coding practices like prepared statements or parameterized queries. The CPE string contains placeholder values (n/a:n/a), indicating limited formal product classification, which is common for smaller open-source projects without vendor CVE coordination. The CVSS vector confirms network-based exploitation requiring no privileges, making it accessible to any remote attacker who can reach the forgot-password endpoint.

RemediationAI

No vendor-released patch identified at time of analysis - PHPGurukul has not published a fixed version via their download page or product announcements. Organizations using version 1.1 should immediately apply these compensating controls: (1) Remove public internet access to forgot-password.php by implementing IP allowlisting or VPN-only access to the entire admin/password-recovery section; trade-off is reduced user self-service capability. (2) Deploy a web application firewall (WAF) with SQL injection signature detection targeting the email parameter in POST requests to forgot-password.php; configure to block rather than just alert; risk of false positives requires testing. (3) Input validation: manually patch the code by implementing prepared statements/parameterized queries for the email lookup in forgot-password.php (consult https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php); requires PHP development expertise and introduces code maintenance burden. (4) Database privilege restriction: ensure the MySQL user account used by the application has SELECT-only permissions on user tables, preventing attackers from using UNION-based injection to access other schemas; does not prevent data exfiltration but limits lateral database movement. Monitor https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/ for researcher updates or patches, and check PHPGurukul download page for version updates beyond 1.1.