Which versions of PHP are affected by CVE-2026-4238?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4238, a SQL injection vulnerability rated CVSS 4.7.

Is there a public PoC exploit available for CVE-2026-4238?

Yes, a public proof-of-concept exploit is available for CVE-2026-4238. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4238?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4238

Q: What is the CVSS score of CVE-2026-4238?

CVE-2026-4238 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12427 LOW

SQL Injection (CWE-89)

2026-03-16 VulDB

PHP SQLi College Management System Itsourcecode

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 13:00 euvd

EUVD-2026-12427

Analysis Generated

Mar 16, 2026 - 13:00 vuln.today

CVE Published

Mar 16, 2026 - 12:32 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/courses.php. The manipulation of the argument course_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode College Management System 1.0 via the course_code parameter in /admin/courses.php allows authenticated administrators to execute arbitrary database queries remotely. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires high-level privileges but could enable data exfiltration or manipulation.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) in the itsourcecode College Management System, a PHP-based educational management platform. The /admin/courses.php file fails to implement proper input validation or parameterized queries when processing the course_code parameter, allowing an attacker to inject malicious SQL syntax directly into database queries. This affects the web application layer where user input is concatenated directly into SQL statements without escaping or prepared statement mechanisms, a fundamental web application security failure in handling untrusted input.

RemediationAI

The primary remediation is to upgrade itsourcecode College Management System to a patched version if available from the vendor; however, given the legacy nature of version 1.0 and unknown patch status (RL:X), organizations should contact itsourcecode support directly to confirm security patches or migration paths. In the interim, implement strict administrative access controls by restricting /admin/courses.php access to trusted internal IP ranges via Web Application Firewall or reverse proxy rules, enforce principle of least privilege for administrator accounts, implement robust logging and monitoring of all administrative SQL queries, and consider using database-level protections such as parameterized queries or stored procedures if source code modifications are possible. Additionally, conduct a security audit of the application's input validation across all parameters and consider migrating to a modern, actively maintained course management system if this product is no longer receiving security updates.