Which versions of PHP are affected by CVE-2026-4241?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4241, a injection vulnerability rated CVSS 6.3.

How to fix or mitigate CVE-2026-4241?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4241

Q: What is the CVSS score of CVE-2026-4241?

CVE-2026-4241 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12436 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-16 cna@vuldb.com

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 14:30 euvd

EUVD-2026-12436

Analysis Generated

Mar 16, 2026 - 14:30 vuln.today

CVE Published

Mar 16, 2026 - 14:20 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was identified in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/time-table.php. Such manipulation of the argument course_code leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode College Management System 1.0 allows authenticated attackers to manipulate the course_code parameter in /admin/time-table.php and execute arbitrary SQL commands remotely. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but can lead to unauthorized data access, modification, or deletion within the application database.

Technical ContextAI

The vulnerability is rooted in improper input validation and parameterization of SQL queries within a PHP-based web application (CWE-74: Improper Neutralization of Special Elements in Output used by a Downstream Component). The affected application is itsourcecode College Management System, a PHP-based administrative tool for educational institutions. The vulnerable endpoint /admin/time-table.php accepts the course_code parameter as user input without adequate prepared statements or input filtering, allowing an attacker to inject malicious SQL syntax directly into database queries. This is a classic SQL injection flaw where user-controlled input is concatenated directly into SQL query strings rather than being properly bound as parameters.

RemediationAI

The primary remediation is to contact itsourcecode for a patched version of College Management System; if available, upgrade to the latest release immediately. In the interim, apply the following compensating controls: implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the course_code parameter (e.g., detect single quotes, SQL keywords like UNION, OR, SELECT); enforce database-level least privilege by restricting the application database user to read-only access where feasible and limiting query permissions; conduct input validation on the course_code parameter using a whitelist of allowed alphanumeric characters and course code format; consider moving the /admin/ directory behind a VPN or IP allowlist to restrict administrative access; and audit recent database access logs for signs of successful SQL injection exploitation. Additionally, implement parameterized queries and prepared statements in the PHP code if source code review is possible.