Which versions of PHP are affected by CVE-2026-4471?

Organizations using A weakness should be aware of moderate risk from CVE-2026-4471, a injection vulnerability rated CVSS 4.7.

How to fix or mitigate CVE-2026-4471?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4471

Q: What is the CVSS score of CVE-2026-4471?

CVE-2026-4471 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13567 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-20 cna@vuldb.com

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13567

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 05:16 nvd

MEDIUM 4.7

DescriptionCVE.org

A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /admin/admin_edit_employee.php. Executing a manipulation of the argument First_Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows authenticated administrators to manipulate the First_Name parameter in /admin/admin_edit_employee.php, enabling remote database compromise. Public exploit code exists for this vulnerability, which requires high-level privileges but carries low complexity for exploitation. The affected system currently lacks an available patch.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection' in broader contexts), which manifests as SQL injection in a PHP-based web application. The affected component is the admin panel's employee management module (/admin/admin_edit_employee.php), which accepts user input via the First_Name parameter without adequate parameterized query construction or input validation. The underlying technology stack involves PHP with MySQL/SQL backend, where direct string concatenation in SQL queries—rather than prepared statements with parameter binding—allows an attacker to inject malicious SQL commands. The administrative context requires prior authentication, but once an admin account is compromised or available, the attack surface becomes immediately exploitable.

RemediationAI

The primary remediation is to contact itsourcecode directly through https://itsourcecode.com/ to obtain a patched version or security update for the Online Frozen Foods Ordering System 1.0, as no official patch version is documented in the available references. If an official patch is unavailable, immediate actions include: (1) restrict administrative access to the /admin/ directory to a whitelist of trusted IP addresses via firewall or reverse proxy rules; (2) implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the First_Name parameter (e.g., detection of single quotes, SQL keywords, or comment sequences); (3) enforce strong authentication for admin accounts with multi-factor authentication to reduce the likelihood of account compromise; (4) apply input validation on the First_Name field to accept only alphanumeric characters and spaces; (5) consider migrating to a supported, maintained ordering system if the vendor cannot provide timely patches. Database-level protections such as principle of least privilege (the database user account running queries should have minimal permissions) should also be enforced as a defense-in-depth measure.