Which versions of PHP are affected by CVE-2026-4472?

Organizations using A security vulnerability should be aware of moderate risk from CVE-2026-4472, a injection vulnerability rated CVSS 6.3.

How to fix or mitigate CVE-2026-4472?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4472

Q: What is the CVSS score of CVE-2026-4472?

CVE-2026-4472 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13569 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-20 cna@vuldb.com

SQLi PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13569

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 05:16 nvd

MEDIUM 6.3

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /admin/admin_edit_supplier.php. The manipulation of the argument Supplier_Name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows authenticated remote attackers to manipulate the Supplier_Name parameter in /admin/admin_edit_supplier.php, potentially enabling data exfiltration or modification. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

This vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output ('Injection')) in a PHP-based web application. The root cause is insufficient input validation and parameterized query handling in the /admin/admin_edit_supplier.php file, where user-supplied input from the Supplier_Name parameter is concatenated directly into SQL queries without proper escaping or prepared statement usage. The affected product is itsourcecode Online Frozen Foods Ordering System 1.0, a PHP application designed for food ordering operations. The lack of proper prepared statements or parameterized query mechanisms allows attackers to break out of intended SQL syntax and execute arbitrary database operations.

RemediationAI

The primary remediation is to contact itsourcecode for a patched version of Online Frozen Foods Ordering System 1.0 or upgrade to a newer version if available. Immediate technical controls should include: (1) applying input validation and output encoding to the Supplier_Name parameter and all user inputs in admin_edit_supplier.php, (2) implementing parameterized/prepared queries for all SQL operations to prevent injection, and (3) enforcing principle of least privilege for database accounts used by the application. As temporary workarounds pending patching, restrict administrative access to the /admin/ directory via network-level controls, limit admin account creation, and implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Supplier_Name parameter. Consult the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-4472 for official patch availability and detailed guidance.