What is the CVSS score of CVE-2026-42474?

CVE-2026-42474 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

MixPHP Framework CVE-2026-42474

EUVD-2026-26675 MEDIUM

SQL Injection (CWE-89)

2026-05-01 mitre

PHP SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 19:23 vuln.today

CVSS changed

May 01, 2026 - 19:22 NVD

6.5 (None) 6.5 (MEDIUM)

EUVD ID Assigned

May 01, 2026 - 16:00 euvd

EUVD-2026-26675

Analysis Generated

May 01, 2026 - 16:00 vuln.today

CVE Published

May 01, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted data array to the data function in BuildHelper.php.

AnalysisAI

SQL injection in MixPHP Framework 2.x through 2.2.17 allows unauthenticated remote attackers to read or modify database contents via a crafted data array passed to the data function in BuildHelper.php. The vulnerability has an automatable exploitation path per CISA SSVC but no public exploit code or active KEV listing identified at analysis time. CVSS 6.5 (medium) reflects network-accessible SQL injection with partial confidentiality and integrity impact but no availability impact.

Technical ContextAI

MixPHP is a PHP web application framework. The vulnerability exists in the BuildHelper.php module, specifically in the data function which handles database query construction. The root cause is CWE-89 (SQL Injection), a classic failure to properly sanitize or parameterize user-supplied input before embedding it into SQL queries. When a developer passes an unsanitized data array to this helper function, attackers can inject arbitrary SQL syntax through the array elements, allowing them to manipulate query logic. The affected versions 2.0.0 through 2.2.17 do not properly escape or use prepared statements for data array inputs, creating a direct SQL injection vector in database operations.

RemediationAI

Upgrade MixPHP Framework to version 2.2.18 or later, which patches the SQL injection in the data function by implementing proper parameterized queries or input sanitization. Consult the official GitHub repository (https://github.com/mix-php/mix) for release notes and upgrade instructions specific to your version. If immediate upgrade is not possible, implement a compensating control by disabling direct use of the vulnerable data function and instead enforcing parameterized query (prepared statement) usage for all database operations; review all code calling BuildHelper::data() and refactor to use parameterized inputs where possible, verifying via code review before deployment. This mitigation has minimal performance overhead but requires developer effort and testing to implement safely across an application. Additionally, implement a Web Application Firewall (WAF) rule to detect and block common SQL injection patterns in input data (e.g., UNION SELECT, OR 1=1), though this is a defense-in-depth measure and not a substitute for patching. Monitor database logs for anomalous SQL patterns as a detective control while awaiting patches.