Which versions of PHP are affected by CVE-2026-4473?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4473, a injection vulnerability rated CVSS 4.7.

How to fix or mitigate CVE-2026-4473?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4473

Q: What is the CVSS score of CVE-2026-4473?

CVE-2026-4473 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13589 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-20 cna@vuldb.com

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13589

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 06:16 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability was detected in itsourcecode Online Doctor Appointment System 1.0. This issue affects some unknown processing of the file /admin/appointment_action.php. The manipulation of the argument appointment_id results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Online Doctor Appointment System 1.0 allows remote attackers with high privileges to manipulate the appointment_id parameter in /admin/appointment_action.php, potentially compromising data confidentiality and integrity. Public exploit code exists for this vulnerability, though no patch is currently available for PHP-based deployments.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-74: Improper Neutralization of Special Elements used in an OS Command) affecting a PHP-based web application. The root cause is insufficient input validation and parameterized query usage in the appointment management functionality. The appointment_id parameter, likely passed via GET or POST request to /admin/appointment_action.php, is concatenated directly into SQL queries without proper escaping or prepared statement implementation. This allows an attacker to break out of the intended SQL context and inject arbitrary SQL commands. The affected product is itsourcecode Online Doctor Appointment System 1.0, a PHP-based healthcare appointment scheduling application identified via EUVD-2026-13589 and confirmed through multiple vulnerability databases including VulDB (IDs 351763, 772883).

RemediationAI

The primary remediation is to upgrade itsourcecode Online Doctor Appointment System to a patched version beyond 1.0, which should address the SQL injection vulnerability through parameterized queries and input validation. Check the vendor website at https://itsourcecode.com/ for available updates and security advisories, or consult https://nvd.nist.gov/vuln/detail/CVE-2026-4473 for official guidance. Until a patch can be deployed, implement compensating controls: restrict administrative access to the appointment management interface via network-level controls (firewall rules limiting admin panel access to trusted IP ranges), disable or remove the Online Doctor Appointment System from internet-facing environments if not in active use, and implement Web Application Firewall (WAF) rules to block SQL injection patterns in the appointment_id parameter (such as detection of single quotes, SQL keywords like UNION or SELECT, and common injection payloads). Additionally, audit database logs for suspicious queries and review admin access logs for unauthorized appointment_action.php requests as indicators of compromise.