Which versions of PHP are affected by CVE-2026-4571?

Organizations using A security flaw should be aware of moderate risk from CVE-2026-4571, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4571?

Yes, a public proof-of-concept exploit is available for CVE-2026-4571. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4571?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4571

Q: What is the CVSS score of CVE-2026-4571?

CVE-2026-4571 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14356 LOW

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-38pm-3998-p6q4

PHP SQLi Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 01:07 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 04:30 euvd

EUVD-2026-14356

Analysis Generated

Mar 23, 2026 - 04:30 vuln.today

CVE Published

Mar 23, 2026 - 03:41 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_payments.php of the component HTTP POST Request Handler. Performing a manipulation of the argument searchtxt results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Sales and Inventory System 1.0 allows remote authenticated attackers to manipulate the searchtxt parameter in /view_payments.php, enabling unauthorized data access and modification. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but can be executed with low complexity over the network.

Technical ContextAI

The vulnerability stems from improper input validation and parameterization in PHP code handling database queries (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). SourceCodester Sales and Inventory System versions at or before 1.0 (identified via CPE cpe:2.3:a:sourcecodester:sales_and_inventory_system:*:*:*:*:*:*:*:*) fail to sanitize the searchtxt POST parameter before incorporating it into SQL statements. The affected component is the HTTP POST Request Handler in /view_payments.php, which processes payment search requests without adequate prepared statements or input escaping. This is a classic SQL injection pattern where user-supplied input is directly concatenated into dynamic SQL queries executed against the backend database.

RemediationAI

Apply a security patch from SourceCodester immediately if available; check the official SourceCodester website at https://www.sourcecodester.com/ and VulDB advisories for patched versions. If patching is not immediately possible, implement the following compensating controls: (1) enforce strong input validation and parameterized prepared statements in the /view_payments.php file by replacing all dynamic SQL with prepared statements using bound parameters, (2) restrict access to the /view_payments.php endpoint to trusted internal networks only via firewall or reverse proxy rules, (3) implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST parameters, particularly the searchtxt field, and (4) enable SQL query logging and monitoring to detect suspicious database activity. For defense-in-depth, apply principle of least privilege to database user accounts so the application database user cannot execute administrative commands.