Which versions of PHP are affected by CVE-2026-4570?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4570, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4570?

Yes, a public proof-of-concept exploit is available for CVE-2026-4570. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4570?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4570

Q: What is the CVSS score of CVE-2026-4570?

CVE-2026-4570 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14355 LOW

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-prpf-w4c2-wf9p

PHP SQLi Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 17:33 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 04:30 euvd

EUVD-2026-14355

Analysis Generated

Mar 23, 2026 - 04:30 vuln.today

CVE Published

Mar 23, 2026 - 03:41 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /view_customers.php of the component HTTP POST Request Handler. Such manipulation of the argument searchtxt leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

SourceCodester Sales and Inventory System 1.0 contains a SQL injection vulnerability in the /view_customers.php endpoint where the searchtxt parameter is insufficiently sanitized, allowing authenticated attackers to execute arbitrary SQL queries and manipulate database contents. The vulnerability requires valid credentials but can be exploited remotely over the network, and public exploit code is available. No patch is currently available for this vulnerability.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP-based web application handling HTTP POST requests. The affected component is the /view_customers.php file, which processes the 'searchtxt' parameter without adequate parameterized query safeguards or input filtering. This is a classic SQL injection vulnerability classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected product, SourceCodester Sales and Inventory System (CPE: cpe:2.3:a:sourcecodester:sales_and_inventory_system:*:*:*:*:*:*:*:*), is a PHP-based inventory management application commonly used in small to medium-sized retail operations. The root cause is the direct concatenation of user-supplied input into SQL query strings without prepared statements or parameterized queries, a fundamental secure coding violation in PHP database interactions.

RemediationAI

Upgrade SourceCodester Sales and Inventory System to the latest patched version released by the vendor (verify current versions at https://www.sourcecodester.com/). If immediate patching is not feasible, implement a web application firewall (WAF) with SQL injection detection rules to filter malicious POST requests to /view_customers.php, and restrict access to the inventory management interface via network-level controls such as VPN enforcement or IP allowlisting. Additionally, enforce principle of least privilege by auditing user accounts within the application and removing unnecessary inventory system access. As a compensating control, enable database query logging and monitor for suspicious SQL patterns in application logs. Parameterized queries or prepared statements must replace all string concatenation in POST request handlers once patching occurs.