What is the CVSS score of CVE-2026-39112?

CVE-2026-39112 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-39112

EUVD-2026-23921 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-20 mitre

GHSA-gpwp-cxm9-hjrq

XSS PHP

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 20, 2026 - 18:28 vuln.today

CVSS changed

Apr 20, 2026 - 18:22 NVD

5.4 (MEDIUM)

EUVD ID Assigned

Apr 20, 2026 - 18:00 euvd

EUVD-2026-23921

Analysis Generated

Apr 20, 2026 - 18:00 vuln.today

CVE Published

Apr 20, 2026 - 00:00 nvd

MEDIUM 5.4

DescriptionCVE.org

Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname parameter of visitors-form.php. An authenticated attacker can inject arbitrary JavaScript that is later executed when the malicious input is viewed in manage-newvisitors.php or visitor-detail.php.

AnalysisAI

Stored cross-site scripting (XSS) in Apartment Visitors Management System v1.1 allows authenticated attackers to inject malicious JavaScript via the visname parameter in visitors-form.php, which executes when other users view the injected data in manage-newvisitors.php or visitor-detail.php. The vulnerability requires user interaction (victim visiting affected pages) and valid authentication but can escalate privileges, steal session tokens, or perform actions on behalf of administrative users viewing visitor records.

Technical ContextAI

This is a stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based apartment management application. The visname parameter in visitors-form.php fails to sanitize or escape user input before storing it in a database. When the stored data is retrieved and rendered in manage-newvisitors.php or visitor-detail.php, the unsanitized JavaScript payload executes in the context of the victim's browser session. The vulnerability affects all versions of Apartment Visitors Management System v1.1 using PHP and MySQL. Unlike reflected XSS, stored XSS persists and can affect multiple users who view the same record, making it more dangerous in multi-user administrative environments.

RemediationAI

Apply input validation and output encoding: (1) In visitors-form.php, sanitize the visname parameter using PHP's htmlspecialchars() function with ENT_QUOTES flag before storing in the database, or use parameterized queries and prepared statements to prevent injection. Example: $visname = htmlspecialchars($_POST['visname'], ENT_QUOTES, 'UTF-8');. (2) In manage-newvisitors.php and visitor-detail.php, ensure all retrieved visitor data is HTML-escaped before rendering: echo htmlspecialchars($row['visname'], ENT_QUOTES, 'UTF-8');. (3) Implement a Content Security Policy (CSP) header to mitigate stored XSS impact: Content-Security-Policy: default-src 'self'; script-src 'self'. (4) As a temporary compensating control if patching is delayed, restrict access to manage-newvisitors.php and visitor-detail.php to trusted administrative users via role-based access control or IP whitelisting, though this does not eliminate the vulnerability. Check the phpgurukul.com repository and GitHub efekaanakkar/Apartment-Visitors-Management-System-CVEs for any released patches or updated versions. No official vendor-released patch version was confirmed in provided data.