Which versions of PHP are affected by CVE-2026-4485?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4485, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4485?

Yes, a public proof-of-concept exploit is available for CVE-2026-4485. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4485?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4485

Q: What is the CVSS score of CVE-2026-4485?

CVE-2026-4485 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13700 LOW

SQL Injection (CWE-89)

2026-03-20 VulDB

PHP SQLi College Management System Itsourcecode

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 14:00 euvd

EUVD-2026-13700

Analysis Generated

Mar 20, 2026 - 14:00 vuln.today

CVE Published

Mar 20, 2026 - 13:32 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/search_student.php. The manipulation of the argument Search leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in the College Management System 1.0 admin search_student.php endpoint allows authenticated attackers to manipulate the Search parameter and execute arbitrary database queries remotely. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to potentially extract, modify, or delete sensitive student data. The vulnerability affects PHP-based installations and currently lacks an available patch.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) within a PHP-based web application. The College Management System uses PHP to process user input from the Search parameter in /admin/search_student.php without proper parameterized queries or input validation before constructing SQL statements. The affected product, identified via CPE (cpe:2.3:a:itsourcecode:college_management_system:*:*:*:*:*:*:*:*), relies on string concatenation or inadequate escaping rather than prepared statements with bound parameters, a common vulnerability pattern in legacy PHP applications that fail to separate code logic from data handling.

RemediationAI

Immediately upgrade itsourcecode College Management System to a patched version released after this disclosure. Until a vendor patch is available, implement the following mitigations: (1) restrict access to /admin/search_student.php to trusted networks via firewall rules or Web Application Firewall (WAF) rules; (2) audit and disable unnecessary administrative accounts to reduce the attack surface; (3) implement prepared statements or parameterized queries in the search functionality to eliminate SQL injection; and (4) monitor database logs for suspicious SQL patterns such as UNION, OR, or comment sequences in the Search parameter. Contact itsourcecode at https://itsourcecode.com/ for available patches and security advisories. If administrative access controls are not robust, consider temporarily disabling the search feature or restricting it to system administrators with strong credential management and multi-factor authentication.