Which versions of PHP are affected by CVE-2026-4469?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4469, a injection vulnerability rated CVSS 4.7.

How to fix or mitigate CVE-2026-4469?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4469

Q: What is the CVSS score of CVE-2026-4469?

CVE-2026-4469 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13563 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-20 cna@vuldb.com

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13563

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 05:16 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_edit_menu_action.php. Such manipulation of the argument product_name leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers with high-level privileges to manipulate the product_name parameter in /admin/admin_edit_menu_action.php, potentially exposing or modifying sensitive database information. Public exploit code for this vulnerability exists, though no patch is currently available.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, or 'Injection') manifesting as SQL injection. The affected application is a PHP-based web ordering system for frozen foods that fails to properly parameterize or escape user input before incorporating it into SQL queries. The vulnerable endpoint /admin/admin_edit_menu_action.php accepts the product_name parameter without adequate input validation or prepared statement usage, allowing attackers to break out of intended SQL context and execute arbitrary SQL commands. This is a classic second-order injection scenario where admin functionality is compromised.

RemediationAI

Immediately upgrade to the latest available version of itsourcecode Online Frozen Foods Ordering System if a patch has been released by the vendor; check https://itsourcecode.com/ and the GitHub repository at https://github.com/sjkdhl/public/issues/4 for patch availability. Until a patch is available, implement input validation and parameterized queries (prepared statements) in the /admin/admin_edit_menu_action.php file to sanitize the product_name parameter before any SQL database operation. Additionally, restrict administrative access via network segmentation, enforce strong authentication on admin accounts, apply a Web Application Firewall (WAF) rule to detect SQL injection patterns in the product_name parameter, and enable comprehensive logging and monitoring of admin panel activities to detect exploitation attempts.