Which versions of PHP are affected by CVE-2026-4569?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4569, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4569?

Yes, a public proof-of-concept exploit is available for CVE-2026-4569. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4569?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4569

Q: What is the CVSS score of CVE-2026-4569?

CVE-2026-4569 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14353 LOW

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-ch6q-jx4x-vgh2

PHP SQLi Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 01:10 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 03:30 euvd

EUVD-2026-14353

Analysis Generated

Mar 23, 2026 - 03:30 vuln.today

CVE Published

Mar 23, 2026 - 02:59 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /view_category.php of the component HTTP POST Request Handler. This manipulation of the argument searchtxt causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SourceCodester Sales and Inventory System 1.0 contains a SQL injection vulnerability in the /view_category.php endpoint's searchtxt parameter that allows authenticated attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, and there is currently no available patch. The attack requires valid credentials but can be executed remotely over the network.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection flaw where user-supplied input from the searchtxt POST parameter is directly concatenated into SQL queries without proper parameterization or input validation. The affected application is built in PHP and uses the Sales and Inventory System framework (CPE: cpe:2.3:a:sourcecodester:sales_and_inventory_system:1.0). The /view_category.php component handles HTTP POST requests but fails to implement prepared statements or parameterized queries, allowing attackers to break out of the intended SQL syntax and inject malicious SQL commands that execute within the database context of the application.

RemediationAI

The primary remediation is to upgrade SourceCodester Sales and Inventory System to a patched version if available from https://www.sourcecodester.com/, or to apply any vendor-released security patches to version 1.0. If upgrading is not immediately feasible, implement input validation and parameterized queries (prepared statements) in the /view_category.php file to sanitize the searchtxt parameter before it is used in any SQL statement. Additionally, restrict access to the application to trusted internal networks via firewall rules or VPN, enforce the principle of least privilege by granting database accounts only necessary permissions (avoid using 'sa' or administrative database accounts), and implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST requests to /view_category.php. Monitor database query logs for suspicious activity and consider running the application in a read-only mode if inventory queries do not require write access.